diff --git a/src/app/Backends/LDAP.php b/src/app/Backends/LDAP.php
index 091096b0..9f258d6d 100644
--- a/src/app/Backends/LDAP.php
+++ b/src/app/Backends/LDAP.php
@@ -1,985 +1,994 @@
 <?php
 
 namespace App\Backends;
 
 use App\Domain;
 use App\Group;
 use App\User;
 
 class LDAP
 {
-    /** @const array UserSettings used by the backend */
+    /** @const array Group settings used by the backend */
+    public const GROUP_SETTINGS = [
+        'sender_policy',
+    ];
+
+    /** @const array User settings used by the backend */
     public const USER_SETTINGS = [
         'first_name',
         'last_name',
         'organization',
     ];
 
     /** @var ?\Net_LDAP3 LDAP connection object */
     protected static $ldap;
 
 
     /**
      * Starts a new LDAP connection that will be used by all methods
      * until you call self::disconnect() explicitely. Normally every
      * method uses a separate connection.
      *
      * @throws \Exception
      */
     public static function connect(): void
     {
         if (empty(self::$ldap)) {
             $config = self::getConfig('admin');
             self::$ldap = self::initLDAP($config);
         }
     }
 
     /**
      * Close the connection created by self::connect()
      */
     public static function disconnect(): void
     {
         if (!empty(self::$ldap)) {
             self::$ldap->close();
             self::$ldap = null;
         }
     }
 
     /**
      * Create a domain in LDAP.
      *
      * @param \App\Domain $domain The domain to create.
      *
      * @throws \Exception
      */
     public static function createDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
         $mgmtRootDN = \config('ldap.admin.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         $aci = [
             '(targetattr = "*")'
             . '(version 3.0; acl "Deny Unauthorized"; deny (all)'
             . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)") '
             . 'AND NOT roledn = "ldap:///cn=kolab-admin,' . $mgmtRootDN . '";)',
 
             '(targetattr != "userPassword")'
             . '(version 3.0;acl "Search Access";allow (read,compare,search)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)");)',
 
             '(targetattr = "*")'
             . '(version 3.0;acl "Kolab Administrators";allow (all)'
             . '(roledn = "ldap:///cn=kolab-admin,' . $domainBaseDN
             . ' || ldap:///cn=kolab-admin,' . $mgmtRootDN . '");)'
         ];
 
         $entry = [
             'aci' => $aci,
             'associateddomain' => $domain->namespace,
             'inetdomainbasedn' => $domainBaseDN,
             'objectclass' => [
                 'top',
                 'domainrelatedobject',
                 'inetdomain'
             ],
         ];
 
         $dn = "associateddomain={$domain->namespace},{$config['domain_base_dn']}";
 
         self::setDomainAttributes($domain, $entry);
 
         if (!$ldap->get_entry($dn)) {
             $result = $ldap->add_entry($dn, $entry);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         // create ou, roles, ous
         $entry = [
             'description' => $domain->namespace,
             'objectclass' => [
                 'top',
                 'organizationalunit'
             ],
             'ou' => $domain->namespace,
         ];
 
         $entry['aci'] = array(
             '(targetattr = "*")'
             . '(version 3.0;acl "Deny Unauthorized"; deny (all)'
             . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)") '
             . 'AND NOT roledn = "ldap:///cn=kolab-admin,' . $mgmtRootDN . '";)',
 
             '(targetattr != "userPassword")'
             . '(version 3.0;acl "Search Access";allow (read,compare,search,write)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)");)',
 
             '(targetattr = "*")'
             . '(version 3.0;acl "Kolab Administrators";allow (all)'
             . '(roledn = "ldap:///cn=kolab-admin,' . $domainBaseDN
             . ' || ldap:///cn=kolab-admin,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///ou=*,' . $domainBaseDN . '")'
             . '(targetattr="objectclass || aci || ou")'
             . '(version 3.0;acl "Allow Domain sub-OU Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///uid=*,ou=People,' . $domainBaseDN . '")(targetattr="*")'
             . '(version 3.0;acl "Allow Domain First User Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///cn=*,' . $domainBaseDN . '")(targetattr="objectclass || cn")'
             . '(version 3.0;acl "Allow Domain Role Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
         );
 
         if (!$ldap->get_entry($domainBaseDN)) {
             $result = $ldap->add_entry($domainBaseDN, $entry);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         foreach (['Groups', 'People', 'Resources', 'Shared Folders'] as $item) {
             if (!$ldap->get_entry("ou={$item},{$domainBaseDN}")) {
                 $result = $ldap->add_entry(
                     "ou={$item},{$domainBaseDN}",
                     [
                         'ou' => $item,
                         'description' => $item,
                         'objectclass' => [
                             'top',
                             'organizationalunit'
                         ]
                     ]
                 );
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         foreach (['kolab-admin'] as $item) {
             if (!$ldap->get_entry("cn={$item},{$domainBaseDN}")) {
                 $result = $ldap->add_entry(
                     "cn={$item},{$domainBaseDN}",
                     [
                         'cn' => $item,
                         'description' => "{$item} role",
                         'objectclass' => [
                             'top',
                             'ldapsubentry',
                             'nsmanagedroledefinition',
                             'nsroledefinition',
                             'nssimpleroledefinition'
                         ]
                     ]
                 );
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         // TODO: Assign kolab-admin role to the owner?
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Create a group in LDAP.
      *
      * @param \App\Group $group The group to create.
      *
      * @throws \Exception
      */
     public static function createGroup(Group $group): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         list($cn, $domainName) = explode('@', $group->email);
 
         $domain = $group->domain();
 
         if (empty($domain)) {
             self::throwException(
                 $ldap,
                 "Failed to create group {$group->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         $groupBaseDN = "ou=Groups,{$domainBaseDN}";
 
         $dn = "cn={$cn},{$groupBaseDN}";
 
         $entry = [
             'cn' => $cn,
             'mail' => $group->email,
             'objectclass' => [
                 'top',
                 'groupofuniquenames',
                 'kolabgroupofuniquenames'
             ],
             'uniquemember' => []
         ];
 
         self::setGroupAttributes($ldap, $group, $entry);
 
         $result = $ldap->add_entry($dn, $entry);
 
         if (!$result) {
             self::throwException(
                 $ldap,
                 "Failed to create group {$group->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Create a user in LDAP.
      *
      * Only need to add user if in any of the local domains? Figure that out here for now. Should
      * have Context-Based Access Controls before the job is queued though, probably.
      *
      * Use one of three modes;
      *
      * 1) The authenticated user account.
      *
      *    * Only valid if the authenticated user is a domain admin.
      *    * We don't know the originating user here.
      *    * We certainly don't have its password anymore.
      *
      * 2) The hosted kolab account.
      *
      * 3) The Directory Manager account.
      *
      * @param \App\User $user The user account to create.
      *
      * @throws \Exception
      */
     public static function createUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $entry = [
             'objectclass' => [
                 'top',
                 'inetorgperson',
                 'inetuser',
                 'kolabinetorgperson',
                 'mailrecipient',
                 'person'
             ],
             'mail' => $user->email,
             'uid' => $user->email,
             'nsroledn' => []
         ];
 
         if (!self::getUserEntry($ldap, $user->email, $dn)) {
             if (empty($dn)) {
                 self::throwException($ldap, "Failed to create user {$user->email} in LDAP (" . __LINE__ . ")");
             }
 
             self::setUserAttributes($user, $entry);
 
             $result = $ldap->add_entry($dn, $entry);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to create user {$user->email} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a domain from LDAP.
      *
      * @param \App\Domain $domain The domain to delete
      *
      * @throws \Exception
      */
     public static function deleteDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
         $mgmtRootDN = \config('ldap.admin.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         if ($ldap->get_entry($domainBaseDN)) {
             $result = $ldap->delete_entry_recursive($domainBaseDN);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete domain {$domain->namespace} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if ($ldap_domain = $ldap->find_domain($domain->namespace)) {
             if ($ldap->get_entry($ldap_domain['dn'])) {
                 $result = $ldap->delete_entry($ldap_domain['dn']);
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to delete domain {$domain->namespace} from LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a group from LDAP.
      *
      * @param \App\Group $group The group to delete.
      *
      * @throws \Exception
      */
     public static function deleteGroup(Group $group): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         if (self::getGroupEntry($ldap, $group->email, $dn)) {
             $result = $ldap->delete_entry($dn);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete group {$group->email} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a user from LDAP.
      *
      * @param \App\User $user The user account to delete.
      *
      * @throws \Exception
      */
     public static function deleteUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         if (self::getUserEntry($ldap, $user->email, $dn)) {
             $result = $ldap->delete_entry($dn);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete user {$user->email} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Get a domain data from LDAP.
      *
      * @param string $namespace The domain name
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getDomain(string $namespace)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $ldapDomain = $ldap->find_domain($namespace);
 
         if ($ldapDomain) {
             $domain = $ldap->get_entry($ldapDomain['dn']);
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $domain ?? null;
     }
 
     /**
      * Get a group data from LDAP.
      *
      * @param string $email The group email.
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getGroup(string $email)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $group = self::getGroupEntry($ldap, $email, $dn);
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $group;
     }
 
     /**
      * Get a user data from LDAP.
      *
      * @param string $email The user email.
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getUser(string $email)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $user = self::getUserEntry($ldap, $email, $dn, true);
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $user;
     }
 
     /**
      * Update a domain in LDAP.
      *
      * @param \App\Domain $domain The domain to update.
      *
      * @throws \Exception
      */
     public static function updateDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $ldapDomain = $ldap->find_domain($domain->namespace);
 
         if (!$ldapDomain) {
             self::throwException(
                 $ldap,
                 "Failed to update domain {$domain->namespace} in LDAP (domain not found)"
             );
         }
 
         $oldEntry = $ldap->get_entry($ldapDomain['dn']);
         $newEntry = $oldEntry;
 
         self::setDomainAttributes($domain, $newEntry);
 
         if (array_key_exists('inetdomainstatus', $newEntry)) {
             $newEntry['inetdomainstatus'] = (string) $newEntry['inetdomainstatus'];
         }
 
         $result = $ldap->modify_entry($ldapDomain['dn'], $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Update a group in LDAP.
      *
      * @param \App\Group $group The group to update
      *
      * @throws \Exception
      */
     public static function updateGroup(Group $group): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         list($cn, $domainName) = explode('@', $group->email);
 
         $domain = $group->domain();
 
         if (empty($domain)) {
             self::throwException(
                 $ldap,
-                "Failed to update group {$group->email} in LDAP (" . __LINE__ . ")"
+                "Failed to update group {$group->email} in LDAP (group not found)"
             );
         }
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         $groupBaseDN = "ou=Groups,{$domainBaseDN}";
 
         $dn = "cn={$cn},{$groupBaseDN}";
 
         $entry = [
             'cn' => $cn,
             'mail' => $group->email,
             'objectclass' => [
                 'top',
                 'groupofuniquenames',
                 'kolabgroupofuniquenames'
             ],
             'uniquemember' => []
         ];
 
         $oldEntry = $ldap->get_entry($dn);
 
         self::setGroupAttributes($ldap, $group, $entry);
 
         $result = $ldap->modify_entry($dn, $oldEntry, $entry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update group {$group->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Update a user in LDAP.
      *
      * @param \App\User $user The user account to update.
      *
      * @throws \Exception
      */
     public static function updateUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $newEntry = $oldEntry = self::getUserEntry($ldap, $user->email, $dn, true);
 
         if (!$oldEntry) {
             self::throwException(
                 $ldap,
                 "Failed to update user {$user->email} in LDAP (user not found)"
             );
         }
 
         self::setUserAttributes($user, $newEntry);
 
         if (array_key_exists('objectclass', $newEntry)) {
             if (!in_array('inetuser', $newEntry['objectclass'])) {
                 $newEntry['objectclass'][] = 'inetuser';
             }
         }
 
         if (array_key_exists('inetuserstatus', $newEntry)) {
             $newEntry['inetuserstatus'] = (string) $newEntry['inetuserstatus'];
         }
 
         if (array_key_exists('mailquota', $newEntry)) {
             $newEntry['mailquota'] = (string) $newEntry['mailquota'];
         }
 
         $result = $ldap->modify_entry($dn, $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update user {$user->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Initialize connection to LDAP
      */
     private static function initLDAP(array $config, string $privilege = 'admin')
     {
         if (self::$ldap) {
             return self::$ldap;
         }
 
         $ldap = new \Net_LDAP3($config);
 
         $connected = $ldap->connect();
 
         if (!$connected) {
             throw new \Exception("Failed to connect to LDAP");
         }
 
         $bound = $ldap->bind(
             \config("ldap.{$privilege}.bind_dn"),
             \config("ldap.{$privilege}.bind_pw")
         );
 
         if (!$bound) {
             throw new \Exception("Failed to bind to LDAP");
         }
 
         return $ldap;
     }
 
     /**
      * Set domain attributes
      */
     private static function setDomainAttributes(Domain $domain, array &$entry)
     {
         $entry['inetdomainstatus'] = $domain->status;
     }
 
     /**
      * Convert group member addresses in to valid entries.
      */
     private static function setGroupAttributes($ldap, Group $group, &$entry)
     {
+        $settings = $group->getSettings(['sender_policy']);
+
+        $entry['kolaballowsmtpsender'] = json_decode($settings['sender_policy'] ?: '[]', true);
+
         $validMembers = [];
 
         $domain = $group->domain();
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         foreach ($group->members as $member) {
             list($local, $domainName) = explode('@', $member);
 
             $memberDN = "uid={$member},ou=People,{$domainBaseDN}";
             $memberEntry = $ldap->get_entry($memberDN);
 
             // if the member is in the local domain but doesn't exist, drop it
             if ($domainName == $domain->namespace && !$memberEntry) {
                 continue;
             }
 
             // add the member if not in the local domain
             if (!$memberEntry) {
                 $memberEntry = [
                     'cn' => $member,
                     'mail' => $member,
                     'objectclass' => [
                         'top',
                         'inetorgperson',
                         'organizationalperson',
                         'person'
                     ],
                     'sn' => 'unknown'
                 ];
 
                 $ldap->add_entry($memberDN, $memberEntry);
             }
 
             $entry['uniquemember'][] = $memberDN;
             $validMembers[] = $member;
         }
 
         // Update members in sql (some might have been removed),
         // skip model events to not invoke another update job
         $group->members = $validMembers;
         Group::withoutEvents(function () use ($group) {
             $group->save();
         });
     }
 
     /**
      * Set common user attributes
      */
     private static function setUserAttributes(User $user, array &$entry)
     {
         $settings = $user->getSettings(['first_name', 'last_name', 'organization']);
 
         $firstName = $settings['first_name'];
         $lastName = $settings['last_name'];
 
         $cn = "unknown";
         $displayname = "";
 
         if ($firstName) {
             if ($lastName) {
                 $cn = "{$firstName} {$lastName}";
                 $displayname = "{$lastName}, {$firstName}";
             } else {
                 $lastName = "unknown";
                 $cn = "{$firstName}";
                 $displayname = "{$firstName}";
             }
         } else {
             $firstName = "";
             if ($lastName) {
                 $cn = "{$lastName}";
                 $displayname = "{$lastName}";
             } else {
                 $lastName = "unknown";
             }
         }
 
         $entry['cn'] = $cn;
         $entry['displayname'] = $displayname;
         $entry['givenname'] = $firstName;
         $entry['sn'] = $lastName;
         $entry['userpassword'] = $user->password_ldap;
         $entry['inetuserstatus'] = $user->status;
         $entry['o'] = $settings['organization'];
         $entry['mailquota'] = 0;
         $entry['alias'] = $user->aliases->pluck('alias')->toArray();
 
         $roles = [];
 
         foreach ($user->entitlements as $entitlement) {
             \Log::debug("Examining {$entitlement->sku->title}");
 
             switch ($entitlement->sku->title) {
                 case "mailbox":
                     break;
 
                 case "storage":
                     $entry['mailquota'] += 1048576;
                     break;
 
                 default:
                     $roles[] = $entitlement->sku->title;
                     break;
             }
         }
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $entry['nsroledn'] = [];
 
         if (in_array("2fa", $roles)) {
             $entry['nsroledn'][] = "cn=2fa-user,{$hostedRootDN}";
         }
 
         if (in_array("activesync", $roles)) {
             $entry['nsroledn'][] = "cn=activesync-user,{$hostedRootDN}";
         }
 
         if (!in_array("groupware", $roles)) {
             $entry['nsroledn'][] = "cn=imap-user,{$hostedRootDN}";
         }
     }
 
     /**
      * Get LDAP configuration for specified access level
      */
     private static function getConfig(string $privilege)
     {
         $config = [
             'domain_base_dn' => \config('ldap.domain_base_dn'),
             'domain_filter' => \config('ldap.domain_filter'),
             'domain_name_attribute' => \config('ldap.domain_name_attribute'),
             'hosts' => \config('ldap.hosts'),
             'sort' => false,
             'vlv' => false,
             'log_hook' => 'App\Backends\LDAP::logHook',
         ];
 
         return $config;
     }
 
     /**
      * Get group entry from LDAP.
      *
      * @param \Net_LDAP3 $ldap  Ldap connection
      * @param string     $email Group email (mail)
      * @param string     $dn    Reference to group DN
      *
      * @return false|null|array Group entry, False on error, NULL if not found
      */
     private static function getGroupEntry($ldap, $email, &$dn = null)
     {
         list($_local, $_domain) = explode('@', $email, 2);
 
         $domain = $ldap->find_domain($_domain);
 
         if (!$domain) {
             return $domain;
         }
 
         $base_dn = $ldap->domain_root_dn($_domain);
         $dn = "cn={$_local},ou=Groups,{$base_dn}";
 
         $entry = $ldap->get_entry($dn);
 
         return $entry ?: null;
     }
 
     /**
      * Get user entry from LDAP.
      *
      * @param \Net_LDAP3 $ldap  Ldap connection
      * @param string     $email User email (uid)
      * @param string     $dn    Reference to user DN
      * @param bool       $full  Get extra attributes, e.g. nsroledn
      *
      * @return false|null|array User entry, False on error, NULL if not found
      */
     private static function getUserEntry($ldap, $email, &$dn = null, $full = false)
     {
         list($_local, $_domain) = explode('@', $email, 2);
 
         $domain = $ldap->find_domain($_domain);
 
         if (!$domain) {
             return $domain;
         }
 
         $base_dn = $ldap->domain_root_dn($_domain);
         $dn = "uid={$email},ou=People,{$base_dn}";
 
         $entry = $ldap->get_entry($dn);
 
         if ($entry && $full) {
             if (!array_key_exists('nsroledn', $entry)) {
                 $roles = $ldap->get_entry_attributes($dn, ['nsroledn']);
                 if (!empty($roles)) {
                     $entry['nsroledn'] = (array) $roles['nsroledn'];
                 }
             }
         }
 
         return $entry ?: null;
     }
 
     /**
      * Logging callback
      */
     public static function logHook($level, $msg): void
     {
         if (
             (
                 $level == LOG_INFO
                 || $level == LOG_DEBUG
                 || $level == LOG_NOTICE
             )
             && !\config('app.debug')
         ) {
             return;
         }
 
         switch ($level) {
             case LOG_CRIT:
                 $function = 'critical';
                 break;
             case LOG_EMERG:
                 $function = 'emergency';
                 break;
             case LOG_ERR:
                 $function = 'error';
                 break;
             case LOG_ALERT:
                 $function = 'alert';
                 break;
             case LOG_WARNING:
                 $function = 'warning';
                 break;
             case LOG_INFO:
                 $function = 'info';
                 break;
             case LOG_DEBUG:
                 $function = 'debug';
                 break;
             case LOG_NOTICE:
                 $function = 'notice';
                 break;
             default:
                 $function = 'info';
         }
 
         if (is_array($msg)) {
             $msg = implode("\n", $msg);
         }
 
         $msg = '[LDAP] ' . $msg;
 
         \Log::{$function}($msg);
     }
 
     /**
      * Throw exception and close the connection when needed
      *
      * @param \Net_LDAP3 $ldap    Ldap connection
      * @param string     $message Exception message
      *
      * @throws \Exception
      */
     private static function throwException($ldap, string $message): void
     {
         if (empty(self::$ldap) && !empty($ldap)) {
             $ldap->close();
         }
 
         throw new \Exception($message);
     }
 }
diff --git a/src/app/Domain.php b/src/app/Domain.php
index acb7d64b..11cdf093 100644
--- a/src/app/Domain.php
+++ b/src/app/Domain.php
@@ -1,510 +1,500 @@
 <?php
 
 namespace App;
 
 use App\Wallet;
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\DomainConfigTrait;
 use App\Traits\EntitleableTrait;
 use App\Traits\SettingsTrait;
 use App\Traits\UuidIntKeyTrait;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Domain.
  *
  * @property string $namespace
  * @property int    $status
  * @property int    $tenant_id
  * @property int    $type
  */
 class Domain extends Model
 {
     use BelongsToTenantTrait;
     use DomainConfigTrait;
     use EntitleableTrait;
     use SettingsTrait;
     use SoftDeletes;
     use UuidIntKeyTrait;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // ownership of the domain has been confirmed
     public const STATUS_CONFIRMED  = 1 << 4;
     // domain has been verified that it exists in DNS
     public const STATUS_VERIFIED   = 1 << 5;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 6;
 
     // open for public registration
     public const TYPE_PUBLIC       = 1 << 0;
     // zone hosted with us
     public const TYPE_HOSTED       = 1 << 1;
     // zone registered externally
     public const TYPE_EXTERNAL     = 1 << 2;
 
     public const HASH_CODE = 1;
     public const HASH_TEXT = 2;
     public const HASH_CNAME = 3;
 
     protected $fillable = [
         'namespace',
         'status',
         'type'
     ];
 
     /**
      * Assign a package to a domain. The domain should not belong to any existing entitlements.
      *
      * @param \App\Package $package The package to assign.
      * @param \App\User    $user    The wallet owner.
      *
      * @return \App\Domain Self
      */
     public function assignPackage($package, $user)
     {
         // If this domain is public it can not be assigned to a user.
         if ($this->isPublic()) {
             return $this;
         }
 
         // See if this domain is already owned by another user.
         $wallet = $this->wallet();
 
         if ($wallet) {
             \Log::error(
                 "Domain {$this->namespace} is already assigned to {$wallet->owner->email}"
             );
 
             return $this;
         }
 
         $wallet_id = $user->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $this->id,
                         'entitleable_type' => Domain::class
                     ]
                 );
             }
         }
 
         return $this;
     }
 
     /**
      * Return list of public+active domain names (for current tenant)
      */
     public static function getPublicDomains(): array
     {
         return self::withEnvTenantContext()
             ->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
             ->get(['namespace'])->pluck('namespace')->toArray();
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is confirmed the ownership of.
      *
      * @return bool
      */
     public function isConfirmed(): bool
     {
         return ($this->status & self::STATUS_CONFIRMED) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is registered with us.
      *
      * @return bool
      */
     public function isExternal(): bool
     {
         return ($this->type & self::TYPE_EXTERNAL) > 0;
     }
 
     /**
      * Returns whether this domain is hosted with us.
      *
      * @return bool
      */
     public function isHosted(): bool
     {
         return ($this->type & self::TYPE_HOSTED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is public.
      *
      * @return bool
      */
     public function isPublic(): bool
     {
         return ($this->type & self::TYPE_PUBLIC) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isVerified(): bool
     {
         return ($this->status & self::STATUS_VERIFIED) > 0;
     }
 
     /**
      * Ensure the namespace is appropriately cased.
      */
     public function setNamespaceAttribute($namespace)
     {
         $this->attributes['namespace'] = strtolower($namespace);
     }
 
     /**
      * Domain status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_CONFIRMED,
             self::STATUS_VERIFIED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid domain status: {$status}");
         }
 
         if ($this->isPublic()) {
             $this->attributes['status'] = $new_status;
             return;
         }
 
         if ($new_status & self::STATUS_CONFIRMED) {
             // if we have confirmed ownership of or management access to the domain, then we have
             // also confirmed the domain exists in DNS.
             $new_status |= self::STATUS_VERIFIED;
             $new_status |= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_DELETED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         if ($new_status & self::STATUS_SUSPENDED && $new_status & self::STATUS_ACTIVE) {
             $new_status ^= self::STATUS_ACTIVE;
         }
 
         // if the domain is now active, it is not new anymore.
         if ($new_status & self::STATUS_ACTIVE && $new_status & self::STATUS_NEW) {
             $new_status ^= self::STATUS_NEW;
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Ownership verification by checking for a TXT (or CNAME) record
      * in the domain's DNS (that matches the verification hash).
      *
      * @return bool True if verification was successful, false otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function confirm(): bool
     {
         if ($this->isConfirmed()) {
             return true;
         }
 
         $hash = $this->hash(self::HASH_TEXT);
         $confirmed = false;
 
         // Get DNS records and find a matching TXT entry
         $records = \dns_get_record($this->namespace, DNS_TXT);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         foreach ($records as $record) {
             if ($record['txt'] === $hash) {
                 $confirmed = true;
                 break;
             }
         }
 
         // Get DNS records and find a matching CNAME entry
         // Note: some servers resolve every non-existing name
         // so we need to define left and right side of the CNAME record
         // i.e.: kolab-verify IN CNAME <hash>.domain.tld.
         if (!$confirmed) {
             $cname = $this->hash(self::HASH_CODE) . '.' . $this->namespace;
             $records = \dns_get_record('kolab-verify.' . $this->namespace, DNS_CNAME);
 
             if ($records === false) {
                 throw new \Exception("Failed to get DNS record for {$this->namespace}");
             }
 
             foreach ($records as $records) {
                 if ($records['target'] === $cname) {
                     $confirmed = true;
                     break;
                 }
             }
         }
 
         if ($confirmed) {
             $this->status |= Domain::STATUS_CONFIRMED;
             $this->save();
         }
 
         return $confirmed;
     }
 
     /**
      * Generate a verification hash for this domain
      *
      * @param int $mod One of: HASH_CNAME, HASH_CODE (Default), HASH_TEXT
      *
      * @return string Verification hash
      */
     public function hash($mod = null): string
     {
         $cname = 'kolab-verify';
 
         if ($mod === self::HASH_CNAME) {
             return $cname;
         }
 
         $hash = \md5('hkccp-verify-' . $this->namespace);
 
         return $mod === self::HASH_TEXT ? "$cname=$hash" : $hash;
     }
 
     /**
      * Checks if there are any objects (users/aliases/groups) in a domain.
      * Note: Public domains are always reported not empty.
      *
      * @return bool True if there are no objects assigned, False otherwise
      */
     public function isEmpty(): bool
     {
         if ($this->isPublic()) {
             return false;
         }
 
         // FIXME: These queries will not use indexes, so maybe we should consider
         // wallet/entitlements to search in objects that belong to this domain account?
 
         $suffix = '@' . $this->namespace;
         $suffixLen = strlen($suffix);
 
         return !(
             \App\User::whereRaw('substr(email, ?) = ?', [-$suffixLen, $suffix])->exists()
             || \App\UserAlias::whereRaw('substr(alias, ?) = ?', [-$suffixLen, $suffix])->exists()
             || \App\Group::whereRaw('substr(email, ?) = ?', [-$suffixLen, $suffix])->exists()
         );
     }
 
-    /**
-     * Any (additional) properties of this domain.
-     *
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
-     */
-    public function settings()
-    {
-        return $this->hasMany('App\DomainSetting', 'domain_id');
-    }
-
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Domain::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this domain.
      *
      * The domain is unsuspended through either of the following courses of actions;
      *
      *   * The account balance has been topped up, or
      *   * a suspected spammer has resolved their issues, or
      *   * the command-line is triggered.
      *
      * Therefore, we can also confidently set the domain status to 'active' should the ownership of or management
      * access to have been confirmed before.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Domain::STATUS_SUSPENDED;
 
         if ($this->isConfirmed() && $this->isVerified()) {
             $this->status |= Domain::STATUS_ACTIVE;
         }
 
         $this->save();
     }
 
     /**
      * List the users of a domain, so long as the domain is not a public registration domain.
      * Note: It returns only users with a mailbox.
      *
      * @return \App\User[] A list of users
      */
     public function users(): array
     {
         if ($this->isPublic()) {
             return [];
         }
 
         $wallet = $this->wallet();
 
         if (!$wallet) {
             return [];
         }
 
         $mailboxSKU = \App\Sku::withObjectTenantContext($this)->where('title', 'mailbox')->first();
 
         if (!$mailboxSKU) {
             \Log::error("No mailbox SKU available.");
             return [];
         }
 
         $entitlements = $wallet->entitlements()
             ->where('entitleable_type', \App\User::class)
             ->where('sku_id', $mailboxSKU->id)->get();
 
         $users = [];
 
         foreach ($entitlements as $entitlement) {
             $users[] = $entitlement->entitleable;
         }
 
         return $users;
     }
 
     /**
      * Verify if a domain exists in DNS
      *
      * @return bool True if registered, False otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function verify(): bool
     {
         if ($this->isVerified()) {
             return true;
         }
 
         $records = \dns_get_record($this->namespace, DNS_ANY);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         // It may happen that result contains other domains depending on the host DNS setup
         // that's why in_array() and not just !empty()
         if (in_array($this->namespace, array_column($records, 'host'))) {
             $this->status |= Domain::STATUS_VERIFIED;
             $this->save();
 
             return true;
         }
 
         return false;
     }
 }
diff --git a/src/app/Group.php b/src/app/Group.php
index 3cbcfad8..5a34fe0b 100644
--- a/src/app/Group.php
+++ b/src/app/Group.php
@@ -1,261 +1,265 @@
 <?php
 
 namespace App;
 
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\EntitleableTrait;
+use App\Traits\GroupConfigTrait;
+use App\Traits\SettingsTrait;
 use App\Traits\UuidIntKeyTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Group.
  *
  * @property int    $id        The group identifier
  * @property string $email     An email address
  * @property string $members   A comma-separated list of email addresses
  * @property int    $status    The group status
  * @property int    $tenant_id Tenant identifier
  */
 class Group extends Model
 {
     use BelongsToTenantTrait;
     use EntitleableTrait;
+    use GroupConfigTrait;
+    use SettingsTrait;
     use SoftDeletes;
     use UuidIntKeyTrait;
 
     // we've simply never heard of this group
     public const STATUS_NEW        = 1 << 0;
     // group has been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // group has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // group has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // group has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
 
     protected $fillable = [
         'email',
         'status',
         'members'
     ];
 
     /**
      * Assign the group to a wallet.
      *
      * @param \App\Wallet $wallet The wallet
      *
      * @return \App\Group Self
      * @throws \Exception
      */
     public function assignToWallet(Wallet $wallet): Group
     {
         if (empty($this->id)) {
             throw new \Exception("Group not yet exists");
         }
 
         if ($this->entitlements()->count()) {
             throw new \Exception("Group already assigned to a wallet");
         }
 
         $sku = \App\Sku::withObjectTenantContext($this)->where('title', 'group')->first();
         $exists = $wallet->entitlements()->where('sku_id', $sku->id)->count();
 
         \App\Entitlement::create([
             'wallet_id' => $wallet->id,
             'sku_id' => $sku->id,
             'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
             'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
             'entitleable_id' => $this->id,
             'entitleable_type' => Group::class
         ]);
 
         return $this;
     }
 
     /**
      * Returns group domain.
      *
      * @return ?\App\Domain The domain group belongs to, NULL if it does not exist
      */
     public function domain(): ?Domain
     {
         list($local, $domainName) = explode('@', $this->email);
 
         return Domain::where('namespace', $domainName)->first();
     }
 
     /**
      * Find whether an email address exists as a group (including deleted groups).
      *
      * @param string $email        Email address
      * @param bool   $return_group Return Group instance instead of boolean
      *
      * @return \App\Group|bool True or Group model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_group = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $group = self::withTrashed()->where('email', $email)->first();
 
         if ($group) {
             return $return_group ? $group : true;
         }
 
         return false;
     }
 
     /**
      * Group members propert accessor. Converts internal comma-separated list into an array
      *
      * @param string $members Comma-separated list of email addresses
      *
      * @return array Email addresses of the group members, as an array
      */
     public function getMembersAttribute($members): array
     {
         return $members ? explode(',', $members) : [];
     }
 
     /**
      * Returns whether this group is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this group is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this group is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this group is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this group is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Ensure the email is appropriately cased.
      *
      * @param string $email Group email address
      */
     public function setEmailAttribute(string $email)
     {
         $this->attributes['email'] = strtolower($email);
     }
 
     /**
      * Ensure the members are appropriately formatted.
      *
      * @param array $members Email addresses of the group members
      */
     public function setMembersAttribute(array $members): void
     {
         $members = array_unique(array_filter(array_map('strtolower', $members)));
 
         sort($members);
 
         $this->attributes['members'] = implode(',', $members);
     }
 
     /**
      * Group status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid group status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Suspend this group.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Group::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this group.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Group::STATUS_SUSPENDED;
         $this->save();
     }
 }
diff --git a/src/app/GroupSetting.php b/src/app/GroupSetting.php
new file mode 100644
index 00000000..904bade7
--- /dev/null
+++ b/src/app/GroupSetting.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App;
+
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * A collection of settings for a Group.
+ *
+ * @property int    $id
+ * @property int    $group_id
+ * @property string $key
+ * @property string $value
+ */
+class GroupSetting extends Model
+{
+    protected $fillable = [
+        'group_id', 'key', 'value'
+    ];
+
+    /**
+     * The group to which this setting belongs.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
+     */
+    public function group()
+    {
+        return $this->belongsTo(\App\Group::class, 'group_id', 'id');
+    }
+}
diff --git a/src/app/Http/Controllers/API/V4/DomainsController.php b/src/app/Http/Controllers/API/V4/DomainsController.php
index 2f1abfbd..e1223006 100644
--- a/src/app/Http/Controllers/API/V4/DomainsController.php
+++ b/src/app/Http/Controllers/API/V4/DomainsController.php
@@ -1,526 +1,526 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Domain;
 use App\Http\Controllers\Controller;
 use App\Backends\LDAP;
 use App\Rules\UserEmailDomain;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 
 class DomainsController extends Controller
 {
     /**
      * Return a list of domains owned by the current user
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
         $list = [];
 
         foreach ($user->domains() as $domain) {
             if (!$domain->isPublic()) {
                 $data = $domain->toArray();
                 $data = array_merge($data, self::domainStatuses($domain));
                 $list[] = $data;
             }
         }
 
         usort($list, function ($a, $b) {
             return strcmp($a['namespace'], $b['namespace']);
         });
 
         return response()->json($list);
     }
 
     /**
      * Show the form for creating a new domain.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function create()
     {
         return $this->errorResponse(404);
     }
 
     /**
      * Confirm ownership of the specified domain (via DNS check).
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function confirm($id)
     {
         $domain = Domain::find($id);
 
         if (!$this->checkTenant($domain)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($domain)) {
             return $this->errorResponse(403);
         }
 
         if (!$domain->confirm()) {
             return response()->json([
                     'status' => 'error',
                     'message' => \trans('app.domain-verify-error'),
             ]);
         }
 
         return response()->json([
                 'status' => 'success',
                 'statusInfo' => self::statusInfo($domain),
                 'message' => \trans('app.domain-verify-success'),
         ]);
     }
 
     /**
      * Remove the specified domain.
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function destroy($id)
     {
         $domain = Domain::withEnvTenantContext()->find($id);
 
         if (empty($domain)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canDelete($domain)) {
             return $this->errorResponse(403);
         }
 
         // It is possible to delete domain only if there are no users/aliases/groups using it.
         if (!$domain->isEmpty()) {
             $response = ['status' => 'error', 'message' => \trans('app.domain-notempty-error')];
             return response()->json($response, 422);
         }
 
         $domain->delete();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.domain-delete-success'),
         ]);
     }
 
     /**
      * Show the form for editing the specified domain.
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function edit($id)
     {
         return $this->errorResponse(404);
     }
 
     /**
      * Set the domain configuration.
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function setConfig($id)
     {
         $domain = Domain::find($id);
 
         if (empty($domain)) {
             return $this->errorResponse(404);
         }
 
         // Only owner (or admin) has access to the domain
-        if (!$this->guard()->user()->canRead($domain)) {
+        if (!$this->guard()->user()->canUpdate($domain)) {
             return $this->errorResponse(403);
         }
 
         $errors = $domain->setConfig(request()->input());
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.domain-setconfig-success'),
         ]);
     }
 
     /**
      * Create a domain.
      *
      * @param \Illuminate\Http\Request $request
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->wallet()->owner;
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         // Validate the input
         $v = Validator::make(
             $request->all(),
             [
                 'namespace' => ['required', 'string', new UserEmailDomain()]
             ]
         );
 
         if ($v->fails()) {
             return response()->json(['status' => 'error', 'errors' => $v->errors()], 422);
         }
 
         $namespace = \strtolower(request()->input('namespace'));
 
         // Domain already exists
         if ($domain = Domain::withTrashed()->where('namespace', $namespace)->first()) {
             // Check if the domain is soft-deleted and belongs to the same user
             $deleteBeforeCreate = $domain->trashed() && ($wallet = $domain->wallet())
                 && $wallet->owner && $wallet->owner->id == $owner->id;
 
             if (!$deleteBeforeCreate) {
                 $errors = ['namespace' => \trans('validation.domainnotavailable')];
                 return response()->json(['status' => 'error', 'errors' => $errors], 422);
             }
         }
 
         if (empty($request->package) || !($package = \App\Package::withEnvTenantContext()->find($request->package))) {
             $errors = ['package' => \trans('validation.packagerequired')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if (!$package->isDomain()) {
             $errors = ['package' => \trans('validation.packageinvalid')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // Force-delete the existing domain if it is soft-deleted and belongs to the same user
         if (!empty($deleteBeforeCreate)) {
             $domain->forceDelete();
         }
 
         // Create the domain
         $domain = Domain::create([
                 'namespace' => $namespace,
                 'type' => \App\Domain::TYPE_EXTERNAL,
         ]);
 
         $domain->assignPackage($package, $owner);
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => __('app.domain-create-success'),
         ]);
     }
 
     /**
      * Get the information about the specified domain.
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse|void
      */
     public function show($id)
     {
         $domain = Domain::find($id);
 
         if (!$this->checkTenant($domain)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($domain)) {
             return $this->errorResponse(403);
         }
 
         $response = $domain->toArray();
 
         // Add hash information to the response
         $response['hash_text'] = $domain->hash(Domain::HASH_TEXT);
         $response['hash_cname'] = $domain->hash(Domain::HASH_CNAME);
         $response['hash_code'] = $domain->hash(Domain::HASH_CODE);
 
         // Add DNS/MX configuration for the domain
         $response['dns'] = self::getDNSConfig($domain);
         $response['mx'] = self::getMXConfig($domain->namespace);
 
         // Domain configuration, e.g. spf whitelist
         $response['config'] = $domain->getConfig();
 
         // Status info
         $response['statusInfo'] = self::statusInfo($domain);
 
         // Entitlements info
         $response['skus'] = \App\Entitlement::objectEntitlementsSummary($domain);
 
         $response = array_merge($response, self::domainStatuses($domain));
 
         // Some basic information about the domain wallet
         $wallet = $domain->wallet();
         $response['wallet'] = $wallet->toArray();
         if ($wallet->discount) {
             $response['wallet']['discount'] = $wallet->discount->discount;
             $response['wallet']['discount_description'] = $wallet->discount->description;
         }
 
         return response()->json($response);
     }
 
     /**
      * Fetch domain status (and reload setup process)
      *
      * @param int $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function status($id)
     {
         $domain = Domain::find($id);
 
         if (!$this->checkTenant($domain)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($domain)) {
             return $this->errorResponse(403);
         }
 
         $response = self::statusInfo($domain);
 
         if (!empty(request()->input('refresh'))) {
             $updated = false;
             $last_step = 'none';
 
             foreach ($response['process'] as $idx => $step) {
                 $last_step = $step['label'];
 
                 if (!$step['state']) {
                     if (!$this->execProcessStep($domain, $step['label'])) {
                         break;
                     }
 
                     $updated = true;
                 }
             }
 
             if ($updated) {
                 $response = self::statusInfo($domain);
             }
 
             $success = $response['isReady'];
             $suffix = $success ? 'success' : 'error-' . $last_step;
 
             $response['status'] = $success ? 'success' : 'error';
             $response['message'] = \trans('app.process-' . $suffix);
         }
 
         $response = array_merge($response, self::domainStatuses($domain));
 
         return response()->json($response);
     }
 
     /**
      * Update the specified domain.
      *
      * @param \Illuminate\Http\Request $request
      * @param int                      $id Domain identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function update(Request $request, $id)
     {
         return $this->errorResponse(404);
     }
 
     /**
      * Provide DNS MX information to configure specified domain for
      */
     protected static function getMXConfig(string $namespace): array
     {
         $entries = [];
 
         // copy MX entries from an existing domain
         if ($master = \config('dns.copyfrom')) {
             // TODO: cache this lookup
             foreach ((array) dns_get_record($master, DNS_MX) as $entry) {
                 $entries[] = sprintf(
                     "@\t%s\t%s\tMX\t%d %s.",
                     \config('dns.ttl', $entry['ttl']),
                     $entry['class'],
                     $entry['pri'],
                     $entry['target']
                 );
             }
         } elseif ($static = \config('dns.static')) {
             $entries[] = strtr($static, array('\n' => "\n", '%s' => $namespace));
         }
 
         // display SPF settings
         if ($spf = \config('dns.spf')) {
             $entries[] = ';';
             foreach (['TXT', 'SPF'] as $type) {
                 $entries[] = sprintf(
                     "@\t%s\tIN\t%s\t\"%s\"",
                     \config('dns.ttl'),
                     $type,
                     $spf
                 );
             }
         }
 
         return $entries;
     }
 
     /**
      * Provide sample DNS config for domain confirmation
      */
     protected static function getDNSConfig(Domain $domain): array
     {
         $serial = date('Ymd01');
         $hash_txt = $domain->hash(Domain::HASH_TEXT);
         $hash_cname = $domain->hash(Domain::HASH_CNAME);
         $hash = $domain->hash(Domain::HASH_CODE);
 
         return [
             "@   IN  SOA ns1.dnsservice.com. hostmaster.{$domain->namespace}. (",
             "        {$serial}  10800  3600  604800  86400 )",
             ";",
             "@       IN  A   <some-ip>",
             "www     IN  A   <some-ip>",
             ";",
             "{$hash_cname}.{$domain->namespace}. IN CNAME {$hash}.{$domain->namespace}.",
             "@   3600    TXT \"{$hash_txt}\"",
         ];
     }
 
     /**
      * Prepare domain statuses for the UI
      *
      * @param \App\Domain $domain Domain object
      *
      * @return array Statuses array
      */
     protected static function domainStatuses(Domain $domain): array
     {
         return [
             'isLdapReady' => $domain->isLdapReady(),
             'isConfirmed' => $domain->isConfirmed(),
             'isVerified' => $domain->isVerified(),
             'isSuspended' => $domain->isSuspended(),
             'isActive' => $domain->isActive(),
             'isDeleted' => $domain->isDeleted() || $domain->trashed(),
         ];
     }
 
     /**
      * Domain status (extended) information.
      *
      * @param \App\Domain $domain Domain object
      *
      * @return array Status information
      */
     public static function statusInfo(Domain $domain): array
     {
         $process = [];
 
         // If that is not a public domain, add domain specific steps
         $steps = [
             'domain-new' => true,
             'domain-ldap-ready' => $domain->isLdapReady(),
             'domain-verified' => $domain->isVerified(),
             'domain-confirmed' => $domain->isConfirmed(),
         ];
 
         $count = count($steps);
 
         // Create a process check list
         foreach ($steps as $step_name => $state) {
             $step = [
                 'label' => $step_name,
                 'title' => \trans("app.process-{$step_name}"),
                 'state' => $state,
             ];
 
             if ($step_name == 'domain-confirmed' && !$state) {
                 $step['link'] = "/domain/{$domain->id}";
             }
 
             $process[] = $step;
 
             if ($state) {
                 $count--;
             }
         }
 
         $state = $count === 0 ? 'done' : 'running';
 
         // After 180 seconds assume the process is in failed state,
         // this should unlock the Refresh button in the UI
         if ($count > 0 && $domain->created_at->diffInSeconds(Carbon::now()) > 180) {
             $state = 'failed';
         }
 
         return [
             'process' => $process,
             'processState' => $state,
             'isReady' => $count === 0,
         ];
     }
 
     /**
      * Execute (synchronously) specified step in a domain setup process.
      *
      * @param \App\Domain $domain Domain object
      * @param string      $step   Step identifier (as in self::statusInfo())
      *
      * @return bool True if the execution succeeded, False otherwise
      */
     public static function execProcessStep(Domain $domain, string $step): bool
     {
         try {
             switch ($step) {
                 case 'domain-ldap-ready':
                     // Domain not in LDAP, create it
                     if (!$domain->isLdapReady()) {
                         LDAP::createDomain($domain);
                         $domain->status |= Domain::STATUS_LDAP_READY;
                         $domain->save();
                     }
                     return $domain->isLdapReady();
 
                 case 'domain-verified':
                     // Domain existence not verified
                     $domain->verify();
                     return $domain->isVerified();
 
                 case 'domain-confirmed':
                     // Domain ownership confirmation
                     $domain->confirm();
                     return $domain->isConfirmed();
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/GroupsController.php b/src/app/Http/Controllers/API/V4/GroupsController.php
index b5ce1778..636b6b42 100644
--- a/src/app/Http/Controllers/API/V4/GroupsController.php
+++ b/src/app/Http/Controllers/API/V4/GroupsController.php
@@ -1,507 +1,541 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\Controller;
 use App\Domain;
 use App\Group;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 
 class GroupsController extends Controller
 {
     /**
      * Show the form for creating a new group.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function create()
     {
         return $this->errorResponse(404);
     }
 
     /**
      * Delete a group.
      *
      * @param int $id Group identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function destroy($id)
     {
         $group = Group::find($id);
 
         if (!$this->checkTenant($group)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canDelete($group)) {
             return $this->errorResponse(403);
         }
 
         $group->delete();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.distlist-delete-success'),
         ]);
     }
 
     /**
      * Show the form for editing the specified group.
      *
      * @param int $id Group identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function edit($id)
     {
         return $this->errorResponse(404);
     }
 
     /**
      * Listing of groups belonging to the authenticated user.
      *
      * The group-entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
 
         $result = $user->groups()->orderBy('email')->get()
             ->map(function (Group $group) {
                 $data = [
                     'id' => $group->id,
                     'email' => $group->email,
                 ];
 
                 $data = array_merge($data, self::groupStatuses($group));
                 return $data;
             });
 
         return response()->json($result);
     }
 
+    /**
+     * Set the group configuration.
+     *
+     * @param int $id Group identifier
+     *
+     * @return \Illuminate\Http\JsonResponse|void
+     */
+    public function setConfig($id)
+    {
+        $group = Group::find($id);
+
+        if (!$this->checkTenant($group)) {
+            return $this->errorResponse(404);
+        }
+
+        if (!$this->guard()->user()->canUpdate($group)) {
+            return $this->errorResponse(403);
+        }
+
+        $errors = $group->setConfig(request()->input());
+
+        if (!empty($errors)) {
+            return response()->json(['status' => 'error', 'errors' => $errors], 422);
+        }
+
+        return response()->json([
+                'status' => 'success',
+                'message' => \trans('app.distlist-setconfig-success'),
+        ]);
+    }
+
     /**
      * Display information of a group specified by $id.
      *
      * @param int $id The group to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         $group = Group::find($id);
 
         if (!$this->checkTenant($group)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($group)) {
             return $this->errorResponse(403);
         }
 
         $response = $group->toArray();
 
         $response = array_merge($response, self::groupStatuses($group));
         $response['statusInfo'] = self::statusInfo($group);
 
+        // Group configuration, e.g. sender_policy
+        $response['config'] = $group->getConfig();
+
         return response()->json($response);
     }
 
     /**
      * Fetch group status (and reload setup process)
      *
      * @param int $id Group identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function status($id)
     {
         $group = Group::find($id);
 
         if (!$this->checkTenant($group)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($group)) {
             return $this->errorResponse(403);
         }
 
         $response = self::statusInfo($group);
 
         if (!empty(request()->input('refresh'))) {
             $updated = false;
             $async = false;
             $last_step = 'none';
 
             foreach ($response['process'] as $idx => $step) {
                 $last_step = $step['label'];
 
                 if (!$step['state']) {
                     $exec = $this->execProcessStep($group, $step['label']);
 
                     if (!$exec) {
                         if ($exec === null) {
                             $async = true;
                         }
 
                         break;
                     }
 
                     $updated = true;
                 }
             }
 
             if ($updated) {
                 $response = self::statusInfo($group);
             }
 
             $success = $response['isReady'];
             $suffix = $success ? 'success' : 'error-' . $last_step;
 
             $response['status'] = $success ? 'success' : 'error';
             $response['message'] = \trans('app.process-' . $suffix);
 
             if ($async && !$success) {
                 $response['processState'] = 'waiting';
                 $response['status'] = 'success';
                 $response['message'] = \trans('app.process-async');
             }
         }
 
         $response = array_merge($response, self::groupStatuses($group));
 
         return response()->json($response);
     }
 
     /**
      * Group status (extended) information
      *
      * @param \App\Group $group Group object
      *
      * @return array Status information
      */
     public static function statusInfo(Group $group): array
     {
         $process = [];
         $steps = [
             'distlist-new' => true,
             'distlist-ldap-ready' => $group->isLdapReady(),
         ];
 
         // Create a process check list
         foreach ($steps as $step_name => $state) {
             $step = [
                 'label' => $step_name,
                 'title' => \trans("app.process-{$step_name}"),
                 'state' => $state,
             ];
 
             $process[] = $step;
         }
 
         $domain = $group->domain();
 
         // If that is not a public domain, add domain specific steps
         if ($domain && !$domain->isPublic()) {
             $domain_status = DomainsController::statusInfo($domain);
             $process = array_merge($process, $domain_status['process']);
         }
 
         $all = count($process);
         $checked = count(array_filter($process, function ($v) {
                 return $v['state'];
         }));
 
         $state = $all === $checked ? 'done' : 'running';
 
         // After 180 seconds assume the process is in failed state,
         // this should unlock the Refresh button in the UI
         if ($all !== $checked && $group->created_at->diffInSeconds(Carbon::now()) > 180) {
             $state = 'failed';
         }
 
         return [
             'process' => $process,
             'processState' => $state,
             'isReady' => $all === $checked,
         ];
     }
 
     /**
      * Create a new group record.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->wallet()->owner;
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         $email = request()->input('email');
         $members = request()->input('members');
         $errors = [];
 
         // Validate group address
         if ($error = GroupsController::validateGroupEmail($email, $owner)) {
             $errors['email'] = $error;
         }
 
         // Validate members' email addresses
         if (empty($members) || !is_array($members)) {
             $errors['members'] = \trans('validation.listmembersrequired');
         } else {
             foreach ($members as $i => $member) {
                 if (is_string($member) && !empty($member)) {
                     if ($error = GroupsController::validateMemberEmail($member, $owner)) {
                         $errors['members'][$i] = $error;
                     } elseif (\strtolower($member) === \strtolower($email)) {
                         $errors['members'][$i] = \trans('validation.memberislist');
                     }
                 } else {
                     unset($members[$i]);
                 }
             }
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // Create the group
         $group = new Group();
         $group->email = $email;
         $group->members = $members;
         $group->save();
 
         $group->assignToWallet($owner->wallets->first());
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.distlist-create-success'),
         ]);
     }
 
     /**
      * Update a group.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      Group identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $group = Group::find($id);
 
         if (!$this->checkTenant($group)) {
             return $this->errorResponse(404);
         }
 
         $current_user = $this->guard()->user();
 
         if (!$current_user->canUpdate($group)) {
             return $this->errorResponse(403);
         }
 
         $owner = $group->wallet()->owner;
 
         // It is possible to update members property only for now
         $members = request()->input('members');
         $errors = [];
 
         // Validate members' email addresses
         if (empty($members) || !is_array($members)) {
             $errors['members'] = \trans('validation.listmembersrequired');
         } else {
             foreach ((array) $members as $i => $member) {
                 if (is_string($member) && !empty($member)) {
                     if ($error = GroupsController::validateMemberEmail($member, $owner)) {
                         $errors['members'][$i] = $error;
                     } elseif (\strtolower($member) === $group->email) {
                         $errors['members'][$i] = \trans('validation.memberislist');
                     }
                 } else {
                     unset($members[$i]);
                 }
             }
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         $group->members = $members;
         $group->save();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.distlist-update-success'),
         ]);
     }
 
     /**
      * Execute (synchronously) specified step in a group setup process.
      *
      * @param \App\Group $group Group object
      * @param string     $step  Step identifier (as in self::statusInfo())
      *
      * @return bool|null True if the execution succeeded, False if not, Null when
      *                   the job has been sent to the worker (result unknown)
      */
     public static function execProcessStep(Group $group, string $step): ?bool
     {
         try {
             if (strpos($step, 'domain-') === 0) {
                 return DomainsController::execProcessStep($group->domain(), $step);
             }
 
             switch ($step) {
                 case 'distlist-ldap-ready':
                     // Group not in LDAP, create it
                     $job = new \App\Jobs\Group\CreateJob($group->id);
                     $job->handle();
 
                     $group->refresh();
 
                     return $group->isLdapReady();
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 
     /**
      * Prepare group statuses for the UI
      *
      * @param \App\Group $group Group object
      *
      * @return array Statuses array
      */
     protected static function groupStatuses(Group $group): array
     {
         return [
             'isLdapReady' => $group->isLdapReady(),
             'isSuspended' => $group->isSuspended(),
             'isActive' => $group->isActive(),
             'isDeleted' => $group->isDeleted() || $group->trashed(),
         ];
     }
 
     /**
      * Validate an email address for use as a group email
      *
      * @param string    $email Email address
      * @param \App\User $user  The group owner
      *
      * @return ?string Error message on validation error
      */
     public static function validateGroupEmail($email, \App\User $user): ?string
     {
         if (empty($email)) {
             return \trans('validation.required', ['attribute' => 'email']);
         }
 
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         list($login, $domain) = explode('@', \strtolower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         // Check if domain exists
         $domain = Domain::where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         $wallet = $domain->wallet();
 
         // The domain must be owned by the user
         if (!$wallet || !$user->wallets()->find($wallet->id)) {
             return \trans('validation.domainnotavailable');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['email' => $login],
             ['email' => [new \App\Rules\UserEmailLocal(true)]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // Check if a user with specified address already exists
         if (User::emailExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         // Check if an alias with specified address already exists.
         if (User::aliasExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         if (Group::emailExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         return null;
     }
 
     /**
      * Validate an email address for use as a group member
      *
      * @param string    $email Email address
      * @param \App\User $user  The group owner
      *
      * @return ?string Error message on validation error
      */
     public static function validateMemberEmail($email, \App\User $user): ?string
     {
         $v = Validator::make(
             ['email' => $email],
             ['email' => [new \App\Rules\ExternalEmail()]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // A local domain user must exist
         if (!User::where('email', \strtolower($email))->first()) {
             list($login, $domain) = explode('@', \strtolower($email));
 
             $domain = Domain::where('namespace', $domain)->first();
 
             // We return an error only if the domain belongs to the group owner
             if ($domain && ($wallet = $domain->wallet()) && $user->wallets()->find($wallet->id)) {
                 return \trans('validation.notalocaluser');
             }
         }
 
         return null;
     }
 }
diff --git a/src/app/Http/Controllers/API/V4/UsersController.php b/src/app/Http/Controllers/API/V4/UsersController.php
index b511d406..0687e308 100644
--- a/src/app/Http/Controllers/API/V4/UsersController.php
+++ b/src/app/Http/Controllers/API/V4/UsersController.php
@@ -1,878 +1,878 @@
 <?php
 
 namespace App\Http\Controllers\API\V4;
 
 use App\Http\Controllers\Controller;
 use App\Domain;
 use App\Group;
 use App\Rules\UserEmailDomain;
 use App\Rules\UserEmailLocal;
 use App\Sku;
 use App\User;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 
 class UsersController extends Controller
 {
     /** @const array List of user setting keys available for modification in UI */
     public const USER_SETTINGS = [
         'billing_address',
         'country',
         'currency',
         'external_email',
         'first_name',
         'last_name',
         'organization',
         'phone',
     ];
 
     /**
      * On user create it is filled with a user or group object to force-delete
      * before the creation of a new user record is possible.
      *
      * @var \App\User|\App\Group|null
      */
     protected $deleteBeforeCreate;
 
 
     /**
      * Delete a user.
      *
      * @param int $id User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function destroy($id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         // User can't remove himself until he's the controller
         if (!$this->guard()->user()->canDelete($user)) {
             return $this->errorResponse(403);
         }
 
         $user->delete();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.user-delete-success'),
         ]);
     }
 
     /**
      * Listing of users.
      *
      * The user-entitlements billed to the current user wallet(s)
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function index()
     {
         $user = $this->guard()->user();
         $search = trim(request()->input('search'));
         $page = intval(request()->input('page')) ?: 1;
         $pageSize = 20;
         $hasMore = false;
 
         $result = $user->users();
 
         // Search by user email, alias or name
         if (strlen($search) > 0) {
             // thanks to cloning we skip some extra queries in $user->users()
             $allUsers1 = clone $result;
             $allUsers2 = clone $result;
 
             $result->whereLike('email', $search)
                 ->union(
                     $allUsers1->join('user_aliases', 'users.id', '=', 'user_aliases.user_id')
                         ->whereLike('alias', $search)
                 )
                 ->union(
                     $allUsers2->join('user_settings', 'users.id', '=', 'user_settings.user_id')
                         ->whereLike('value', $search)
                         ->whereIn('key', ['first_name', 'last_name'])
                 );
         }
 
         $result = $result->orderBy('email')
             ->limit($pageSize + 1)
             ->offset($pageSize * ($page - 1))
             ->get();
 
         if (count($result) > $pageSize) {
             $result->pop();
             $hasMore = true;
         }
 
         // Process the result
         $result = $result->map(
             function ($user) {
                 $data = $user->toArray();
                 $data = array_merge($data, self::userStatuses($user));
                 return $data;
             }
         );
 
         $result = [
             'list' => $result,
             'count' => count($result),
             'hasMore' => $hasMore,
         ];
 
         return response()->json($result);
     }
 
     /**
      * Set user config.
      *
      * @param int $id The user
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function setConfig($id)
     {
         $user = User::find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
-        if (!$this->guard()->user()->canRead($user)) {
+        if (!$this->guard()->user()->canUpdate($user)) {
             return $this->errorResponse(403);
         }
 
         $errors = $user->setConfig(request()->input());
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.user-setconfig-success'),
         ]);
     }
 
     /**
      * Display information on the user account specified by $id.
      *
      * @param int $id The account to show information for.
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function show($id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = $this->userResponse($user);
 
         $response['skus'] = \App\Entitlement::objectEntitlementsSummary($user);
         $response['config'] = $user->getConfig();
 
         return response()->json($response);
     }
 
     /**
      * Fetch user status (and reload setup process)
      *
      * @param int $id User identifier
      *
      * @return \Illuminate\Http\JsonResponse
      */
     public function status($id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         if (!$this->guard()->user()->canRead($user)) {
             return $this->errorResponse(403);
         }
 
         $response = self::statusInfo($user);
 
         if (!empty(request()->input('refresh'))) {
             $updated = false;
             $async = false;
             $last_step = 'none';
 
             foreach ($response['process'] as $idx => $step) {
                 $last_step = $step['label'];
 
                 if (!$step['state']) {
                     $exec = $this->execProcessStep($user, $step['label']);
 
                     if (!$exec) {
                         if ($exec === null) {
                             $async = true;
                         }
 
                         break;
                     }
 
                     $updated = true;
                 }
             }
 
             if ($updated) {
                 $response = self::statusInfo($user);
             }
 
             $success = $response['isReady'];
             $suffix = $success ? 'success' : 'error-' . $last_step;
 
             $response['status'] = $success ? 'success' : 'error';
             $response['message'] = \trans('app.process-' . $suffix);
 
             if ($async && !$success) {
                 $response['processState'] = 'waiting';
                 $response['status'] = 'success';
                 $response['message'] = \trans('app.process-async');
             }
         }
 
         $response = array_merge($response, self::userStatuses($user));
 
         return response()->json($response);
     }
 
     /**
      * User status (extended) information
      *
      * @param \App\User $user User object
      *
      * @return array Status information
      */
     public static function statusInfo(User $user): array
     {
         $process = [];
         $steps = [
             'user-new' => true,
             'user-ldap-ready' => $user->isLdapReady(),
             'user-imap-ready' => $user->isImapReady(),
         ];
 
         // Create a process check list
         foreach ($steps as $step_name => $state) {
             $step = [
                 'label' => $step_name,
                 'title' => \trans("app.process-{$step_name}"),
                 'state' => $state,
             ];
 
             $process[] = $step;
         }
 
         list ($local, $domain) = explode('@', $user->email);
         $domain = Domain::where('namespace', $domain)->first();
 
         // If that is not a public domain, add domain specific steps
         if ($domain && !$domain->isPublic()) {
             $domain_status = DomainsController::statusInfo($domain);
             $process = array_merge($process, $domain_status['process']);
         }
 
         $all = count($process);
         $checked = count(array_filter($process, function ($v) {
                 return $v['state'];
         }));
 
         $state = $all === $checked ? 'done' : 'running';
 
         // After 180 seconds assume the process is in failed state,
         // this should unlock the Refresh button in the UI
         if ($all !== $checked && $user->created_at->diffInSeconds(Carbon::now()) > 180) {
             $state = 'failed';
         }
 
         // Check if the user is a controller of his wallet
         $isController = $user->canDelete($user);
         $hasCustomDomain = $user->wallet()->entitlements()
             ->where('entitleable_type', Domain::class)
             ->count() > 0;
 
         // Get user's entitlements titles
         $skus = $user->entitlements()->select('skus.title')
             ->join('skus', 'skus.id', '=', 'entitlements.sku_id')
             ->get()
             ->pluck('title')
             ->sort()
             ->unique()
             ->values()
             ->all();
 
         return [
             'skus' => $skus,
             // TODO: This will change when we enable all users to create domains
             'enableDomains' => $isController && $hasCustomDomain,
             // TODO: Make 'enableDistlists' working for wallet controllers that aren't account owners
             'enableDistlists' => $isController && $hasCustomDomain && in_array('distlist', $skus),
             'enableUsers' => $isController,
             'enableWallets' => $isController,
             'process' => $process,
             'processState' => $state,
             'isReady' => $all === $checked,
         ];
     }
 
     /**
      * Create a new user record.
      *
      * @param \Illuminate\Http\Request $request The API request.
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function store(Request $request)
     {
         $current_user = $this->guard()->user();
         $owner = $current_user->wallet()->owner;
 
         if ($owner->id != $current_user->id) {
             return $this->errorResponse(403);
         }
 
         $this->deleteBeforeCreate = null;
 
         if ($error_response = $this->validateUserRequest($request, null, $settings)) {
             return $error_response;
         }
 
         if (empty($request->package) || !($package = \App\Package::withEnvTenantContext()->find($request->package))) {
             $errors = ['package' => \trans('validation.packagerequired')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         if ($package->isDomain()) {
             $errors = ['package' => \trans('validation.packageinvalid')];
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         DB::beginTransaction();
 
         // @phpstan-ignore-next-line
         if ($this->deleteBeforeCreate) {
             $this->deleteBeforeCreate->forceDelete();
         }
 
         // Create user record
         $user = User::create([
                 'email' => $request->email,
                 'password' => $request->password,
         ]);
 
         $owner->assignPackage($package, $user);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         DB::commit();
 
         return response()->json([
                 'status' => 'success',
                 'message' => \trans('app.user-create-success'),
         ]);
     }
 
     /**
      * Update user data.
      *
      * @param \Illuminate\Http\Request $request The API request.
      * @param string                   $id      User identifier
      *
      * @return \Illuminate\Http\JsonResponse The response
      */
     public function update(Request $request, $id)
     {
         $user = User::withEnvTenantContext()->find($id);
 
         if (empty($user)) {
             return $this->errorResponse(404);
         }
 
         $current_user = $this->guard()->user();
 
         // TODO: Decide what attributes a user can change on his own profile
         if (!$current_user->canUpdate($user)) {
             return $this->errorResponse(403);
         }
 
         if ($error_response = $this->validateUserRequest($request, $user, $settings)) {
             return $error_response;
         }
 
         // Entitlements, only controller can do that
         if ($request->skus !== null && !$current_user->canDelete($user)) {
             return $this->errorResponse(422, "You have no permission to change entitlements");
         }
 
         DB::beginTransaction();
 
         $this->updateEntitlements($user, $request->skus);
 
         if (!empty($settings)) {
             $user->setSettings($settings);
         }
 
         if (!empty($request->password)) {
             $user->password = $request->password;
             $user->save();
         }
 
         if (isset($request->aliases)) {
             $user->setAliases($request->aliases);
         }
 
         // TODO: Make sure that UserUpdate job is created in case of entitlements update
         //       and no password change. So, for example quota change is applied to LDAP
         // TODO: Review use of $user->save() in the above context
 
         DB::commit();
 
         $response = [
             'status' => 'success',
             'message' => \trans('app.user-update-success'),
         ];
 
         // For self-update refresh the statusInfo in the UI
         if ($user->id == $current_user->id) {
             $response['statusInfo'] = self::statusInfo($user);
         }
 
         return response()->json($response);
     }
 
     /**
      * Update user entitlements.
      *
      * @param \App\User $user  The user
      * @param array     $rSkus List of SKU IDs requested for the user in the form [id=>qty]
      */
     protected function updateEntitlements(User $user, $rSkus)
     {
         if (!is_array($rSkus)) {
             return;
         }
 
         // list of skus, [id=>obj]
         $skus = Sku::withEnvTenantContext()->get()->mapWithKeys(
             function ($sku) {
                 return [$sku->id => $sku];
             }
         );
 
         // existing entitlement's SKUs
         $eSkus = [];
 
         $user->entitlements()->groupBy('sku_id')
             ->selectRaw('count(*) as total, sku_id')->each(
                 function ($e) use (&$eSkus) {
                     $eSkus[$e->sku_id] = $e->total;
                 }
             );
 
         foreach ($skus as $skuID => $sku) {
             $e = array_key_exists($skuID, $eSkus) ? $eSkus[$skuID] : 0;
             $r = array_key_exists($skuID, $rSkus) ? $rSkus[$skuID] : 0;
 
             if ($sku->handler_class == \App\Handlers\Mailbox::class) {
                 if ($r != 1) {
                     throw new \Exception("Invalid quantity of mailboxes");
                 }
             }
 
             if ($e > $r) {
                 // remove those entitled more than existing
                 $user->removeSku($sku, ($e - $r));
             } elseif ($e < $r) {
                 // add those requested more than entitled
                 $user->assignSku($sku, ($r - $e));
             }
         }
     }
 
     /**
      * Create a response data array for specified user.
      *
      * @param \App\User $user User object
      *
      * @return array Response data
      */
     public static function userResponse(User $user): array
     {
         $response = $user->toArray();
 
         // Settings
         $response['settings'] = [];
         foreach ($user->settings()->whereIn('key', self::USER_SETTINGS)->get() as $item) {
             $response['settings'][$item->key] = $item->value;
         }
 
         // Aliases
         $response['aliases'] = [];
         foreach ($user->aliases as $item) {
             $response['aliases'][] = $item->alias;
         }
 
         // Status info
         $response['statusInfo'] = self::statusInfo($user);
 
         $response = array_merge($response, self::userStatuses($user));
 
         // Add more info to the wallet object output
         $map_func = function ($wallet) use ($user) {
             $result = $wallet->toArray();
 
             if ($wallet->discount) {
                 $result['discount'] = $wallet->discount->discount;
                 $result['discount_description'] = $wallet->discount->description;
             }
 
             if ($wallet->user_id != $user->id) {
                 $result['user_email'] = $wallet->owner->email;
             }
 
             $provider = \App\Providers\PaymentProvider::factory($wallet);
             $result['provider'] = $provider->name();
 
             return $result;
         };
 
         // Information about wallets and accounts for access checks
         $response['wallets'] = $user->wallets->map($map_func)->toArray();
         $response['accounts'] = $user->accounts->map($map_func)->toArray();
         $response['wallet'] = $map_func($user->wallet());
 
         return $response;
     }
 
     /**
      * Prepare user statuses for the UI
      *
      * @param \App\User $user User object
      *
      * @return array Statuses array
      */
     protected static function userStatuses(User $user): array
     {
         return [
             'isImapReady' => $user->isImapReady(),
             'isLdapReady' => $user->isLdapReady(),
             'isSuspended' => $user->isSuspended(),
             'isActive' => $user->isActive(),
             'isDeleted' => $user->isDeleted() || $user->trashed(),
         ];
     }
 
     /**
      * Validate user input
      *
      * @param \Illuminate\Http\Request $request  The API request.
      * @param \App\User|null           $user     User identifier
      * @param array                    $settings User settings (from the request)
      *
      * @return \Illuminate\Http\JsonResponse|null The error response on error
      */
     protected function validateUserRequest(Request $request, $user, &$settings = [])
     {
         $rules = [
             'external_email' => 'nullable|email',
             'phone' => 'string|nullable|max:64|regex:/^[0-9+() -]+$/',
             'first_name' => 'string|nullable|max:128',
             'last_name' => 'string|nullable|max:128',
             'organization' => 'string|nullable|max:512',
             'billing_address' => 'string|nullable|max:1024',
             'country' => 'string|nullable|alpha|size:2',
             'currency' => 'string|nullable|alpha|size:3',
             'aliases' => 'array|nullable',
         ];
 
         if (empty($user) || !empty($request->password) || !empty($request->password_confirmation)) {
             $rules['password'] = 'required|min:4|max:2048|confirmed';
         }
 
         $errors = [];
 
         // Validate input
         $v = Validator::make($request->all(), $rules);
 
         if ($v->fails()) {
             $errors = $v->errors()->toArray();
         }
 
         $controller = $user ? $user->wallet()->owner : $this->guard()->user();
 
         // For new user validate email address
         if (empty($user)) {
             $email = $request->email;
 
             if (empty($email)) {
                 $errors['email'] = \trans('validation.required', ['attribute' => 'email']);
             } elseif ($error = self::validateEmail($email, $controller, $this->deleteBeforeCreate)) {
                 $errors['email'] = $error;
             }
         }
 
         // Validate aliases input
         if (isset($request->aliases)) {
             $aliases = [];
             $existing_aliases = $user ? $user->aliases()->get()->pluck('alias')->toArray() : [];
 
             foreach ($request->aliases as $idx => $alias) {
                 if (is_string($alias) && !empty($alias)) {
                     // Alias cannot be the same as the email address (new user)
                     if (!empty($email) && Str::lower($alias) == Str::lower($email)) {
                         continue;
                     }
 
                     // validate new aliases
                     if (
                         !in_array($alias, $existing_aliases)
                         && ($error = self::validateAlias($alias, $controller))
                     ) {
                         if (!isset($errors['aliases'])) {
                             $errors['aliases'] = [];
                         }
                         $errors['aliases'][$idx] = $error;
                         continue;
                     }
 
                     $aliases[] = $alias;
                 }
             }
 
             $request->aliases = $aliases;
         }
 
         if (!empty($errors)) {
             return response()->json(['status' => 'error', 'errors' => $errors], 422);
         }
 
         // Update user settings
         $settings = $request->only(array_keys($rules));
         unset($settings['password'], $settings['aliases'], $settings['email']);
 
         return null;
     }
 
     /**
      * Execute (synchronously) specified step in a user setup process.
      *
      * @param \App\User $user User object
      * @param string    $step Step identifier (as in self::statusInfo())
      *
      * @return bool|null True if the execution succeeded, False if not, Null when
      *                   the job has been sent to the worker (result unknown)
      */
     public static function execProcessStep(User $user, string $step): ?bool
     {
         try {
             if (strpos($step, 'domain-') === 0) {
                 list ($local, $domain) = explode('@', $user->email);
                 $domain = Domain::where('namespace', $domain)->first();
 
                 return DomainsController::execProcessStep($domain, $step);
             }
 
             switch ($step) {
                 case 'user-ldap-ready':
                     // User not in LDAP, create it
                     $job = new \App\Jobs\User\CreateJob($user->id);
                     $job->handle();
 
                     $user->refresh();
 
                     return $user->isLdapReady();
 
                 case 'user-imap-ready':
                     // User not in IMAP? Verify again
                     // Do it synchronously if the imap admin credentials are available
                     // otherwise let the worker do the job
                     if (!\config('imap.admin_password')) {
                         \App\Jobs\User\VerifyJob::dispatch($user->id);
 
                         return null;
                     }
 
                     $job = new \App\Jobs\User\VerifyJob($user->id);
                     $job->handle();
 
                     $user->refresh();
 
                     return $user->isImapReady();
             }
         } catch (\Exception $e) {
             \Log::error($e);
         }
 
         return false;
     }
 
     /**
      * Email address validation for use as a user mailbox (login).
      *
      * @param string                    $email   Email address
      * @param \App\User                 $user    The account owner
      * @param null|\App\User|\App\Group $deleted Filled with an instance of a deleted user or group
      *                                           with the specified email address, if exists
      *
      * @return ?string Error message on validation error
      */
     public static function validateEmail(string $email, \App\User $user, &$deleted = null): ?string
     {
         $deleted = null;
 
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'email']);
         }
 
         // Check if domain exists
         $domain = Domain::withEnvTenantContext()->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['email' => $login],
             ['email' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['email'][0];
         }
 
         // Check if it is one of domains available to the user
         $domains = \collect($user->domains())->pluck('namespace')->all();
 
         if (!in_array($domain->namespace, $domains)) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // If this is a deleted user in the same custom domain
             // we'll force delete him before
             if (!$domain->isPublic() && $existing_user->trashed()) {
                 $deleted = $existing_user;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         // Check if an alias with specified address already exists.
         if (User::aliasExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'email']);
         }
 
         // Check if a group with specified address already exists
         if ($existing_group = Group::emailExists($email, true)) {
             // If this is a deleted group in the same custom domain
             // we'll force delete it before
             if (!$domain->isPublic() && $existing_group->trashed()) {
                 $deleted = $existing_group;
             } else {
                 return \trans('validation.entryexists', ['attribute' => 'email']);
             }
         }
 
         return null;
     }
 
     /**
      * Email address validation for use as an alias.
      *
      * @param string    $email Email address
      * @param \App\User $user  The account owner
      *
      * @return ?string Error message on validation error
      */
     public static function validateAlias(string $email, \App\User $user): ?string
     {
         if (strpos($email, '@') === false) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         list($login, $domain) = explode('@', Str::lower($email));
 
         if (strlen($login) === 0 || strlen($domain) === 0) {
             return \trans('validation.entryinvalid', ['attribute' => 'alias']);
         }
 
         // Check if domain exists
         $domain = Domain::withEnvTenantContext()->where('namespace', $domain)->first();
 
         if (empty($domain)) {
             return \trans('validation.domaininvalid');
         }
 
         // Validate login part alone
         $v = Validator::make(
             ['alias' => $login],
             ['alias' => ['required', new UserEmailLocal(!$domain->isPublic())]]
         );
 
         if ($v->fails()) {
             return $v->errors()->toArray()['alias'][0];
         }
 
         // Check if it is one of domains available to the user
         $domains = \collect($user->domains())->pluck('namespace')->all();
 
         if (!in_array($domain->namespace, $domains)) {
             return \trans('validation.entryexists', ['attribute' => 'domain']);
         }
 
         // Check if a user with specified address already exists
         if ($existing_user = User::emailExists($email, true)) {
             // Allow an alias in a custom domain to an address that was a user before
             if ($domain->isPublic() || !$existing_user->trashed()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if an alias with specified address already exists
         if (User::aliasExists($email)) {
             // Allow assigning the same alias to a user in the same group account,
             // but only for non-public domains
             if ($domain->isPublic()) {
                 return \trans('validation.entryexists', ['attribute' => 'alias']);
             }
         }
 
         // Check if a group with specified address already exists
         if (Group::emailExists($email)) {
             return \trans('validation.entryexists', ['attribute' => 'alias']);
         }
 
         return null;
     }
 }
diff --git a/src/app/Observers/GroupSettingObserver.php b/src/app/Observers/GroupSettingObserver.php
new file mode 100644
index 00000000..3d73dd8c
--- /dev/null
+++ b/src/app/Observers/GroupSettingObserver.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Observers;
+
+use App\Backends\LDAP;
+use App\GroupSetting;
+
+class GroupSettingObserver
+{
+    /**
+     * Handle the group setting "created" event.
+     *
+     * @param \App\GroupSetting $groupSetting Settings object
+     *
+     * @return void
+     */
+    public function created(GroupSetting $groupSetting)
+    {
+        if (in_array($groupSetting->key, LDAP::GROUP_SETTINGS)) {
+            \App\Jobs\Group\UpdateJob::dispatch($groupSetting->group_id);
+        }
+    }
+
+    /**
+     * Handle the group setting "updated" event.
+     *
+     * @param \App\GroupSetting $groupSetting Settings object
+     *
+     * @return void
+     */
+    public function updated(GroupSetting $groupSetting)
+    {
+        if (in_array($groupSetting->key, LDAP::GROUP_SETTINGS)) {
+            \App\Jobs\Group\UpdateJob::dispatch($groupSetting->group_id);
+        }
+    }
+
+    /**
+     * Handle the group setting "deleted" event.
+     *
+     * @param \App\GroupSetting $groupSetting Settings object
+     *
+     * @return void
+     */
+    public function deleted(GroupSetting $groupSetting)
+    {
+        if (in_array($groupSetting->key, LDAP::GROUP_SETTINGS)) {
+            \App\Jobs\Group\UpdateJob::dispatch($groupSetting->group_id);
+        }
+    }
+}
diff --git a/src/app/Providers/AppServiceProvider.php b/src/app/Providers/AppServiceProvider.php
index d9e3e68d..38b742a0 100644
--- a/src/app/Providers/AppServiceProvider.php
+++ b/src/app/Providers/AppServiceProvider.php
@@ -1,161 +1,162 @@
 <?php
 
 namespace App\Providers;
 
 use Illuminate\Database\Query\Builder;
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\ServiceProvider;
 use Laravel\Passport\Passport;
 
 class AppServiceProvider extends ServiceProvider
 {
     /**
      * Register any application services.
      *
      * @return void
      */
     public function register()
     {
         Passport::ignoreMigrations();
     }
 
     /**
      * Serialize a bindings array to a string.
      *
      * @return string
      */
     private static function serializeSQLBindings(array $array): string
     {
         $serialized = array_map(function ($entry) {
             if ($entry instanceof \DateTime) {
                 return $entry->format('Y-m-d h:i:s');
             }
             return $entry;
         }, $array);
         return implode(', ', $serialized);
     }
 
     /**
      * Bootstrap any application services.
      *
      * @return void
      */
     public function boot()
     {
         \App\Domain::observe(\App\Observers\DomainObserver::class);
         \App\Entitlement::observe(\App\Observers\EntitlementObserver::class);
         \App\Group::observe(\App\Observers\GroupObserver::class);
+        \App\GroupSetting::observe(\App\Observers\GroupSettingObserver::class);
         \App\OpenVidu\Connection::observe(\App\Observers\OpenVidu\ConnectionObserver::class);
         \App\PackageSku::observe(\App\Observers\PackageSkuObserver::class);
         \App\PlanPackage::observe(\App\Observers\PlanPackageObserver::class);
         \App\SignupCode::observe(\App\Observers\SignupCodeObserver::class);
         \App\SignupInvitation::observe(\App\Observers\SignupInvitationObserver::class);
         \App\Transaction::observe(\App\Observers\TransactionObserver::class);
         \App\User::observe(\App\Observers\UserObserver::class);
         \App\UserAlias::observe(\App\Observers\UserAliasObserver::class);
         \App\UserSetting::observe(\App\Observers\UserSettingObserver::class);
         \App\VerificationCode::observe(\App\Observers\VerificationCodeObserver::class);
         \App\Wallet::observe(\App\Observers\WalletObserver::class);
 
         \App\PowerDNS\Domain::observe(\App\Observers\PowerDNS\DomainObserver::class);
         \App\PowerDNS\Record::observe(\App\Observers\PowerDNS\RecordObserver::class);
 
         Schema::defaultStringLength(191);
 
         // Log SQL queries in debug mode
         if (\config('app.debug')) {
             DB::listen(function ($query) {
                 \Log::debug(
                     sprintf(
                         '[SQL] %s [%s]: %.4f sec.',
                         $query->sql,
                         self::serializeSQLBindings($query->bindings),
                         $query->time / 1000
                     )
                 );
             });
         }
 
         // Register some template helpers
         Blade::directive(
             'theme_asset',
             function ($path) {
                 $path = trim($path, '/\'"');
                 return "<?php echo secure_asset('themes/' . \$env['app.theme'] . '/' . '$path'); ?>";
             }
         );
 
         Builder::macro(
             'withEnvTenantContext',
             function (string $table = null) {
                 $tenantId = \config('app.tenant_id');
 
                 if ($tenantId) {
                     /** @var Builder $this */
                     return $this->where(($table ? "$table." : "") . "tenant_id", $tenantId);
                 }
 
                 /** @var Builder $this */
                 return $this->whereNull(($table ? "$table." : "") . "tenant_id");
             }
         );
 
         Builder::macro(
             'withObjectTenantContext',
             function (object $object, string $table = null) {
                 $tenantId = $object->tenant_id;
 
                 if ($tenantId) {
                     /** @var Builder $this */
                     return $this->where(($table ? "$table." : "") . "tenant_id", $tenantId);
                 }
 
                 /** @var Builder $this */
                 return $this->whereNull(($table ? "$table." : "") . "tenant_id");
             }
         );
 
         Builder::macro(
             'withSubjectTenantContext',
             function (string $table = null) {
                 if ($user = auth()->user()) {
                     $tenantId = $user->tenant_id;
                 } else {
                     $tenantId = \config('app.tenant_id');
                 }
 
                 if ($tenantId) {
                     /** @var Builder $this */
                     return $this->where(($table ? "$table." : "") . "tenant_id", $tenantId);
                 }
 
                 /** @var Builder $this */
                 return $this->whereNull(($table ? "$table." : "") . "tenant_id");
             }
         );
 
         // Query builder 'whereLike' mocro
         Builder::macro(
             'whereLike',
             function (string $column, string $search, int $mode = 0) {
                 $search = addcslashes($search, '%_');
 
                 switch ($mode) {
                     case 2:
                         $search .= '%';
                         break;
                     case 1:
                         $search = '%' . $search;
                         break;
                     default:
                         $search = '%' . $search . '%';
                 }
 
                 /** @var Builder $this */
                 return $this->where($column, 'like', $search);
             }
         );
     }
 }
diff --git a/src/app/Tenant.php b/src/app/Tenant.php
index a4b572bf..6a05c730 100644
--- a/src/app/Tenant.php
+++ b/src/app/Tenant.php
@@ -1,105 +1,95 @@
 <?php
 
 namespace App;
 
 use App\Traits\SettingsTrait;
 use Illuminate\Database\Eloquent\Model;
 
 /**
  * The eloquent definition of a Tenant.
  *
  * @property int    $id
  * @property string $title
  */
 class Tenant extends Model
 {
     use SettingsTrait;
 
     protected $fillable = [
         'id',
         'title',
     ];
 
     protected $keyType = 'bigint';
 
     /**
      * Utility method to get tenant-specific system setting.
      * If the setting is not specified for the tenant a system-wide value will be returned.
      *
      * @param int    $tenantId Tenant identifier
      * @param string $key      Setting name
      *
      * @return mixed Setting value
      */
     public static function getConfig($tenantId, string $key)
     {
         // Cache the tenant instance in memory
         static $tenant;
 
         if (empty($tenant) || $tenant->id != $tenantId) {
             $tenant = null;
             if ($tenantId) {
                 $tenant = self::findOrFail($tenantId);
             }
         }
 
         // Supported options (TODO: document this somewhere):
         // - app.name (tenants.title will be returned)
         // - app.public_url and app.url
         // - app.support_url
         // - mail.from.address and mail.from.name
         // - mail.reply_to.address and mail.reply_to.name
         // - app.kb.account_delete and app.kb.account_suspended
         // - pgp.enable
 
         if ($key == 'app.name') {
             return $tenant ? $tenant->title : \config($key);
         }
 
         $value = $tenant ? $tenant->getSetting($key) : null;
 
         return $value !== null ? $value : \config($key);
     }
 
     /**
      * Discounts assigned to this tenant.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function discounts()
     {
         return $this->hasMany('App\Discount');
     }
 
-    /**
-     * Any (additional) settings of this tenant.
-     *
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
-     */
-    public function settings()
-    {
-        return $this->hasMany('App\TenantSetting');
-    }
-
     /**
      * SignupInvitations assigned to this tenant.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function signupInvitations()
     {
         return $this->hasMany('App\SignupInvitation');
     }
 
     /*
      * Returns the wallet of the tanant (reseller's wallet).
      *
      * @return ?\App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         $user = \App\User::where('role', 'reseller')->where('tenant_id', $this->id)->first();
 
         return $user ? $user->wallets->first() : null;
     }
 }
diff --git a/src/app/Traits/GroupConfigTrait.php b/src/app/Traits/GroupConfigTrait.php
new file mode 100644
index 00000000..0eb6231e
--- /dev/null
+++ b/src/app/Traits/GroupConfigTrait.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Traits;
+
+trait GroupConfigTrait
+{
+    /**
+     * A helper to get the group configuration.
+     */
+    public function getConfig(): array
+    {
+        $config = [];
+
+        $sp = $this->getSetting('sender_policy');
+
+        $config['sender_policy'] = array_filter(
+            $sp ? json_decode($sp, true) : [],
+            function ($item) {
+                // remove the special "-" entry, it's an implementation detail
+                return $item !== '-';
+            }
+        );
+
+        return $config;
+    }
+
+    /**
+     * A helper to update a group configuration.
+     *
+     * @param array $config An array of configuration options
+     *
+     * @return array A list of input validation errors
+     */
+    public function setConfig(array $config): array
+    {
+        $errors = [];
+
+        foreach ($config as $key => $value) {
+            // validate and save SMTP sender policy entries
+            if ($key === 'sender_policy') {
+                if (!is_array($value)) {
+                    $value = (array) $value;
+                }
+
+                foreach ($value as $i => $v) {
+                    if (!is_string($v)) {
+                        $errors[$key][$i] = \trans('validation.sp-entry-invalid');
+                    }
+                }
+
+                if (empty($errors[$key])) {
+                    // remove empty entries, and '-' entry
+                    $value = array_filter($value, function ($item) {
+                        return strlen($item) > 0 && $item !== '-';
+                    });
+
+                    if (!empty($value)) {
+                        $value[] = '-'; // Block anyone not on the list
+                    }
+
+                    $this->setSetting($key, json_encode($value));
+                }
+            } else {
+                $errors[$key] = \trans('validation.invalid-config-parameter');
+            }
+        }
+
+        return $errors;
+    }
+}
diff --git a/src/app/Traits/SettingsTrait.php b/src/app/Traits/SettingsTrait.php
index 96888d34..dc73c0e7 100644
--- a/src/app/Traits/SettingsTrait.php
+++ b/src/app/Traits/SettingsTrait.php
@@ -1,134 +1,144 @@
 <?php
 
 namespace App\Traits;
 
 trait SettingsTrait
 {
     /**
      * Obtain the value for a setting.
      *
      * Example Usage:
      *
      * ```php
      * $user = User::firstOrCreate(['email' => 'some@other.erg']);
      * $locale = $user->getSetting('locale');
      * ```
      *
      * @param string $key     Setting name
      * @param mixed  $default Default value, to be used if not found
      *
      * @return string|null Setting value
      */
     public function getSetting(string $key, $default = null)
     {
         $setting = $this->settings()->where('key', $key)->first();
 
         return $setting ? $setting->value : $default;
     }
 
     /**
      * Obtain the values for many settings in one go (for better performance).
      *
      * @param array $keys Setting names
      *
      * @return array Setting key=value hash, includes also requested but non-existing settings
      */
     public function getSettings(array $keys): array
     {
         $settings = [];
 
         foreach ($keys as $key) {
             $settings[$key] = null;
         }
 
         $this->settings()->whereIn('key', $keys)->get()
             ->each(function ($setting) use (&$settings) {
                 $settings[$setting->key] = $setting->value;
             });
 
         return $settings;
     }
 
     /**
      * Remove a setting.
      *
      * Example Usage:
      *
      * ```php
      * $user = User::firstOrCreate(['email' => 'some@other.erg']);
      * $user->removeSetting('locale');
      * ```
      *
      * @param string $key Setting name
      *
      * @return void
      */
     public function removeSetting(string $key): void
     {
         $this->setSetting($key, null);
     }
 
     /**
      * Create or update a setting.
      *
      * Example Usage:
      *
      * ```php
      * $user = User::firstOrCreate(['email' => 'some@other.erg']);
      * $user->setSetting('locale', 'en');
      * ```
      *
      * @param string      $key   Setting name
      * @param string|null $value The new value for the setting.
      *
      * @return void
      */
     public function setSetting(string $key, $value): void
     {
         $this->storeSetting($key, $value);
     }
 
     /**
      * Create or update multiple settings in one fell swoop.
      *
      * Example Usage:
      *
      * ```php
      * $user = User::firstOrCreate(['email' => 'some@other.erg']);
      * $user->setSettings(['locale' => 'en', 'country' => 'GB']);
      * ```
      *
      * @param array $data An associative array of key value pairs.
      *
      * @return void
      */
     public function setSettings(array $data = []): void
     {
         foreach ($data as $key => $value) {
             $this->storeSetting($key, $value);
         }
     }
 
+    /**
+     * Any (additional) properties of this domain.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\HasMany
+     */
+    public function settings()
+    {
+        return $this->hasMany(self::class . 'Setting');
+    }
+
     /**
      * Create or update a setting.
      *
      * @param string      $key   Setting name
      * @param string|null $value The new value for the setting.
      *
      * @return void
      */
     private function storeSetting(string $key, $value): void
     {
         if ($value === null || $value === '') {
             // Note: We're selecting the record first, so observers can act
             if ($setting = $this->settings()->where('key', $key)->first()) {
                 $setting->delete();
             }
         } else {
             $this->settings()->updateOrCreate(
                 ['key' => $key],
                 ['value' => $value]
             );
         }
     }
 }
diff --git a/src/app/User.php b/src/app/User.php
index c1cd9600..f3e28556 100644
--- a/src/app/User.php
+++ b/src/app/User.php
@@ -1,866 +1,856 @@
 <?php
 
 namespace App;
 
 use App\Entitlement;
 use App\UserAlias;
 use App\Sku;
 use App\Traits\BelongsToTenantTrait;
 use App\Traits\EntitleableTrait;
 use App\Traits\UserAliasesTrait;
 use App\Traits\UserConfigTrait;
 use App\Traits\UuidIntKeyTrait;
 use App\Traits\SettingsTrait;
 use App\Wallet;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Iatstuti\Database\Support\NullableFields;
 use Laravel\Passport\HasApiTokens;
 use League\OAuth2\Server\Exception\OAuthServerException;
 
 /**
  * The eloquent definition of a User.
  *
  * @property string $email
  * @property int    $id
  * @property string $password
  * @property int    $status
  * @property int    $tenant_id
  */
 class User extends Authenticatable
 {
     use BelongsToTenantTrait;
     use EntitleableTrait;
     use HasApiTokens;
     use NullableFields;
     use UserConfigTrait;
     use UserAliasesTrait;
     use UuidIntKeyTrait;
     use SettingsTrait;
     use SoftDeletes;
 
     // a new user, default on creation
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // user has been suspended
     public const STATUS_SUSPENDED  = 1 << 2;
     // user has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // user has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 4;
     // user mailbox has been created in IMAP
     public const STATUS_IMAP_READY = 1 << 5;
 
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'id',
         'email',
         'password',
         'password_ldap',
         'status',
     ];
 
     /**
      * The attributes that should be hidden for arrays.
      *
      * @var array
      */
     protected $hidden = [
         'password',
         'password_ldap',
         'role'
     ];
 
     protected $nullable = [
         'password',
         'password_ldap'
     ];
 
     /**
      * Any wallets on which this user is a controller.
      *
      * This does not include wallets owned by the user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function accounts()
     {
         return $this->belongsToMany(
             'App\Wallet',       // The foreign object definition
             'user_accounts',    // The table name
             'user_id',          // The local foreign key
             'wallet_id'         // The remote foreign key
         );
     }
 
     /**
      * Email aliases of this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function aliases()
     {
         return $this->hasMany('App\UserAlias', 'user_id');
     }
 
     /**
      * Assign a package to a user. The user should not have any existing entitlements.
      *
      * @param \App\Package   $package The package to assign.
      * @param \App\User|null $user    Assign the package to another user.
      *
      * @return \App\User
      */
     public function assignPackage($package, $user = null)
     {
         if (!$user) {
             $user = $this;
         }
 
         $wallet_id = $this->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'fee' => $sku->pivot->fee(),
                         'entitleable_id' => $user->id,
                         'entitleable_type' => User::class
                     ]
                 );
             }
         }
 
         return $user;
     }
 
     /**
      * Assign a package plan to a user.
      *
      * @param \App\Plan   $plan   The plan to assign
      * @param \App\Domain $domain Optional domain object
      *
      * @return \App\User Self
      */
     public function assignPlan($plan, $domain = null): User
     {
         $this->setSetting('plan_id', $plan->id);
 
         foreach ($plan->packages as $package) {
             if ($package->isDomain()) {
                 $domain->assignPackage($package, $this);
             } else {
                 $this->assignPackage($package);
             }
         }
 
         return $this;
     }
 
     /**
      * Assign a Sku to a user.
      *
      * @param \App\Sku $sku   The sku to assign.
      * @param int      $count Count of entitlements to add
      *
      * @return \App\User Self
      * @throws \Exception
      */
     public function assignSku(Sku $sku, int $count = 1): User
     {
         // TODO: I guess wallet could be parametrized in future
         $wallet = $this->wallet();
         $exists = $this->entitlements()->where('sku_id', $sku->id)->count();
 
         while ($count > 0) {
             \App\Entitlement::create([
                 'wallet_id' => $wallet->id,
                 'sku_id' => $sku->id,
                 'cost' => $exists >= $sku->units_free ? $sku->cost : 0,
                 'fee' => $exists >= $sku->units_free ? $sku->fee : 0,
                 'entitleable_id' => $this->id,
                 'entitleable_type' => User::class
             ]);
 
             $exists++;
             $count--;
         }
 
         return $this;
     }
 
     /**
      * Check if current user can delete another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canDelete($object): bool
     {
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         // TODO: For now controller can delete/update the account owner,
         //       this may change in future, controllers are not 0-regression feature
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can read data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canRead($object): bool
     {
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         if ($object instanceof Wallet) {
             return $object->user_id == $this->id || $object->controllers->contains($this);
         }
 
         if (!method_exists($object, 'wallet')) {
             return false;
         }
 
         $wallet = $object->wallet();
 
         return $wallet && ($wallet->user_id == $this->id || $this->accounts->contains($wallet));
     }
 
     /**
      * Check if current user can update data of another object.
      *
      * @param mixed $object A user|domain|wallet|group object
      *
      * @return bool True if he can, False otherwise
      */
     public function canUpdate($object): bool
     {
         if ($object instanceof User && $this->id == $object->id) {
             return true;
         }
 
         if ($this->role == 'admin') {
             return true;
         }
 
         if ($this->role == 'reseller') {
             if ($object instanceof User && $object->role == 'admin') {
                 return false;
             }
 
             if ($object instanceof Wallet && !empty($object->owner)) {
                 $object = $object->owner;
             }
 
             return isset($object->tenant_id) && $object->tenant_id == $this->tenant_id;
         }
 
         return $this->canDelete($object);
     }
 
     /**
      * Return the \App\Domain for this user.
      *
      * @return \App\Domain|null
      */
     public function domain()
     {
         list($local, $domainName) = explode('@', $this->email);
 
         $domain = \App\Domain::withTrashed()->where('namespace', $domainName)->first();
 
         return $domain;
     }
 
     /**
      * List the domains to which this user is entitled.
      * Note: Active public domains are also returned (for the user tenant).
      *
      * @return Domain[] List of Domain objects
      */
     public function domains(): array
     {
         if ($this->tenant_id) {
             $domains = Domain::where('tenant_id', $this->tenant_id);
         } else {
             $domains = Domain::withEnvTenantContext();
         }
 
         $domains = $domains->whereRaw(sprintf('(type & %s)', Domain::TYPE_PUBLIC))
             ->whereRaw(sprintf('(status & %s)', Domain::STATUS_ACTIVE))
             ->get()
             ->all();
 
         foreach ($this->wallets as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
                 $domains[] = $entitlement->entitleable;
             }
         }
 
         foreach ($this->accounts as $wallet) {
             $entitlements = $wallet->entitlements()->where('entitleable_type', Domain::class)->get();
             foreach ($entitlements as $entitlement) {
                 $domains[] = $entitlement->entitleable;
             }
         }
 
         return $domains;
     }
 
     /**
      * Find whether an email address exists as a user (including deleted users).
      *
      * @param string $email       Email address
      * @param bool   $return_user Return User instance instead of boolean
      *
      * @return \App\User|bool True or User model object if found, False otherwise
      */
     public static function emailExists(string $email, bool $return_user = false)
     {
         if (strpos($email, '@') === false) {
             return false;
         }
 
         $email = \strtolower($email);
 
         $user = self::withTrashed()->where('email', $email)->first();
 
         if ($user) {
             return $return_user ? $user : true;
         }
 
         return false;
     }
 
     /**
      * Helper to find user by email address, whether it is
      * main email address, alias or an external email.
      *
      * If there's more than one alias NULL will be returned.
      *
      * @param string $email    Email address
      * @param bool   $external Search also for an external email
      *
      * @return \App\User|null User model object if found
      */
     public static function findByEmail(string $email, bool $external = false): ?User
     {
         if (strpos($email, '@') === false) {
             return null;
         }
 
         $email = \strtolower($email);
 
         $user = self::where('email', $email)->first();
 
         if ($user) {
             return $user;
         }
 
         $aliases = UserAlias::where('alias', $email)->get();
 
         if (count($aliases) == 1) {
             return $aliases->first()->user;
         }
 
         // TODO: External email
 
         return null;
     }
 
 
 
     /**
      * Return groups controlled by the current user.
      *
      * @param bool $with_accounts Include groups assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function groups($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         return Group::select(['groups.*', 'entitlements.wallet_id'])
             ->distinct()
             ->join('entitlements', 'entitlements.entitleable_id', '=', 'groups.id')
             ->whereIn('entitlements.wallet_id', $wallets)
             ->where('entitlements.entitleable_type', Group::class);
     }
 
     /**
      * Check if user has an entitlement for the specified SKU.
      *
      * @param string $title The SKU title
      *
      * @return bool True if specified SKU entitlement exists
      */
     public function hasSku(string $title): bool
     {
         $sku = Sku::withObjectTenantContext($this)->where('title', $title)->first();
 
         if (!$sku) {
             return false;
         }
 
         return $this->entitlements()->where('sku_id', $sku->id)->count() > 0;
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isImapReady(): bool
     {
         return ($this->status & self::STATUS_IMAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this user is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * A shortcut to get the user name.
      *
      * @param bool $fallback Return "<aa.name> User" if there's no name
      *
      * @return string Full user name
      */
     public function name(bool $fallback = false): string
     {
         $settings = $this->getSettings(['first_name', 'last_name']);
 
         $name = trim($settings['first_name'] . ' ' . $settings['last_name']);
 
         if (empty($name) && $fallback) {
             return trim(\trans('app.siteuser', ['site' => \App\Tenant::getConfig($this->tenant_id, 'app.name')]));
         }
 
         return $name;
     }
 
     /**
      * Remove a number of entitlements for the SKU.
      *
      * @param \App\Sku $sku   The SKU
      * @param int      $count The number of entitlements to remove
      *
      * @return User Self
      */
     public function removeSku(Sku $sku, int $count = 1): User
     {
         $entitlements = $this->entitlements()
             ->where('sku_id', $sku->id)
             ->orderBy('cost', 'desc')
             ->orderBy('created_at')
             ->get();
 
         $entitlements_count = count($entitlements);
 
         foreach ($entitlements as $entitlement) {
             if ($entitlements_count <= $sku->units_free) {
                 continue;
             }
 
             if ($count > 0) {
                 $entitlement->delete();
                 $entitlements_count--;
                 $count--;
             }
         }
 
         return $this;
     }
 
     public function senderPolicyFrameworkWhitelist($clientName)
     {
         $setting = $this->getSetting('spf_whitelist');
 
         if (!$setting) {
             return false;
         }
 
         $whitelist = json_decode($setting);
 
         $matchFound = false;
 
         foreach ($whitelist as $entry) {
             if (substr($entry, 0, 1) == '/') {
                 $match = preg_match($entry, $clientName);
 
                 if ($match) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if (substr($entry, 0, 1) == '.') {
                 if (substr($clientName, (-1 * strlen($entry))) == $entry) {
                     $matchFound = true;
                 }
 
                 continue;
             }
 
             if ($entry == $clientName) {
                 $matchFound = true;
                 continue;
             }
         }
 
         return $matchFound;
     }
 
-    /**
-     * Any (additional) properties of this user.
-     *
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
-     */
-    public function settings()
-    {
-        return $this->hasMany('App\UserSetting', 'user_id');
-    }
-
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this domain.
      *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= User::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Return users controlled by the current user.
      *
      * @param bool $with_accounts Include users assigned to wallets
      *                            the current user controls but not owns.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function users($with_accounts = true)
     {
         $wallets = $this->wallets()->pluck('id')->all();
 
         if ($with_accounts) {
             $wallets = array_merge($wallets, $this->accounts()->pluck('wallet_id')->all());
         }
 
         return $this->select(['users.*', 'entitlements.wallet_id'])
             ->distinct()
             ->leftJoin('entitlements', 'entitlements.entitleable_id', '=', 'users.id')
             ->whereIn('entitlements.wallet_id', $wallets)
             ->where('entitlements.entitleable_type', User::class);
     }
 
     /**
      * Verification codes for this user.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function verificationcodes()
     {
         return $this->hasMany('App\VerificationCode', 'user_id', 'id');
     }
 
     /**
      * Wallets this user owns.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function wallets()
     {
         return $this->hasMany('App\Wallet');
     }
 
     /**
      * User password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordAttribute($password)
     {
         if (!empty($password)) {
             $this->attributes['password'] = bcrypt($password, [ "rounds" => 12 ]);
             $this->attributes['password_ldap'] = '{SSHA512}' . base64_encode(
                 pack('H*', hash('sha512', $password))
             );
         }
     }
 
     /**
      * User LDAP password mutator
      *
      * @param string $password The password in plain text.
      *
      * @return void
      */
     public function setPasswordLdapAttribute($password)
     {
         $this->setPasswordAttribute($password);
     }
 
     /**
      * User status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
             self::STATUS_LDAP_READY,
             self::STATUS_IMAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid user status: {$status}");
         }
 
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Validate the user credentials
      *
      * @param string $username       The username.
      * @param string $password       The password in plain text.
      * @param bool   $updatePassword Store the password if currently empty
      *
      * @return bool true on success
      */
     public function validateCredentials(string $username, string $password, bool $updatePassword = true): bool
     {
         $authenticated = false;
 
         if ($this->email === \strtolower($username)) {
             if (!empty($this->password)) {
                 if (Hash::check($password, $this->password)) {
                     $authenticated = true;
                 }
             } elseif (!empty($this->password_ldap)) {
                 if (substr($this->password_ldap, 0, 6) == "{SSHA}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 6)), 20);
 
                     $hash = '{SSHA}' . base64_encode(
                         sha1($password . $salt, true) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 } elseif (substr($this->password_ldap, 0, 9) == "{SSHA512}") {
                     $salt = substr(base64_decode(substr($this->password_ldap, 9)), 64);
 
                     $hash = '{SSHA512}' . base64_encode(
                         pack('H*', hash('sha512', $password . $salt)) . $salt
                     );
 
                     if ($hash == $this->password_ldap) {
                         $authenticated = true;
                     }
                 }
             } else {
                 \Log::error("Incomplete credentials for {$this->email}");
             }
         }
 
         if ($authenticated) {
             \Log::info("Successful authentication for {$this->email}");
 
             // TODO: update last login time
             if ($updatePassword && (empty($this->password) || empty($this->password_ldap))) {
                 $this->password = $password;
                 $this->save();
             }
         } else {
             // TODO: Try actual LDAP?
             \Log::info("Authentication failed for {$this->email}");
         }
 
         return $authenticated;
     }
 
     /**
      * Retrieve and authenticate a user
      *
      * @param string $username     The username.
      * @param string $password     The password in plain text.
      * @param string $secondFactor The second factor (secondfactor from current request is used as fallback).
      *
      * @return array ['user', 'reason', 'errorMessage']
      */
     public static function findAndAuthenticate($username, $password, $secondFactor = null): ?array
     {
         $user = User::where('email', $username)->first();
         if (!$user) {
             return ['reason' => 'notfound', 'errorMessage' => "User not found."];
         }
 
         if (!$user->validateCredentials($username, $password)) {
             return ['reason' => 'credentials', 'errorMessage' => "Invalid password."];
         }
 
 
 
         if (!$secondFactor) {
             // Check the request if there is a second factor provided
             // as fallback.
             $secondFactor = request()->secondfactor;
         }
 
         try {
             (new \App\Auth\SecondFactor($user))->validate($secondFactor);
         } catch (\Exception $e) {
             return ['reason' => 'secondfactor', 'errorMessage' => $e->getMessage()];
         }
 
         return ['user' => $user];
     }
 
     /**
      * Hook for passport
      *
      * @throws \Throwable
      *
      * @return \App\User User model object if found
      */
     public function findAndValidateForPassport($username, $password): User
     {
         $result = self::findAndAuthenticate($username, $password);
 
         if (isset($result['reason'])) {
             if ($result['reason'] == 'secondfactor') {
                 // This results in a json response of {'error': 'secondfactor', 'error_description': '$errorMessage'}
                 throw new OAuthServerException($result['errorMessage'], 6, 'secondfactor', 401);
             }
             throw OAuthServerException::invalidCredentials();
         }
         return $result['user'];
     }
 }
diff --git a/src/app/Wallet.php b/src/app/Wallet.php
index cc8d505b..9a241264 100644
--- a/src/app/Wallet.php
+++ b/src/app/Wallet.php
@@ -1,436 +1,426 @@
 <?php
 
 namespace App;
 
 use App\User;
 use App\Traits\SettingsTrait;
 use App\Traits\UuidStrKeyTrait;
 use Carbon\Carbon;
 use Iatstuti\Database\Support\NullableFields;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\DB;
 
 /**
  * The eloquent definition of a wallet -- a container with a chunk of change.
  *
  * A wallet is owned by an {@link \App\User}.
  *
  * @property int        $balance     Current balance in cents
  * @property string     $currency    Currency code
  * @property ?string    $description Description
  * @property string     $id          Unique identifier
  * @property ?\App\User $owner       Owner (can be null when owner is deleted)
  * @property int        $user_id     Owner's identifier
  */
 class Wallet extends Model
 {
     use NullableFields;
     use SettingsTrait;
     use UuidStrKeyTrait;
 
     public $timestamps = false;
 
     /**
      * The attributes' default values.
      *
      * @var array
      */
     protected $attributes = [
         'balance' => 0,
     ];
 
     /**
      * The attributes that are mass assignable.
      *
      * @var array
      */
     protected $fillable = [
         'currency',
         'description'
     ];
 
     /**
      * The attributes that can be not set.
      *
      * @var array
      */
     protected $nullable = [
         'description',
     ];
 
     /**
      * The types of attributes to which its values will be cast
      *
      * @var array
      */
     protected $casts = [
         'balance' => 'integer',
     ];
 
 
     /**
      * Add a controller to this wallet.
      *
      * @param \App\User $user The user to add as a controller to this wallet.
      *
      * @return void
      */
     public function addController(User $user)
     {
         if (!$this->controllers->contains($user)) {
             $this->controllers()->save($user);
         }
     }
 
     public function chargeEntitlements($apply = true)
     {
         // This wallet has been created less than a month ago, this is the trial period
         if ($this->owner->created_at >= Carbon::now()->subMonthsWithoutOverflow(1)) {
             // Move all the current entitlement's updated_at timestamps forward to one month after
             // this wallet was created.
             $freeMonthEnds = $this->owner->created_at->copy()->addMonthsWithoutOverflow(1);
 
             foreach ($this->entitlements()->get()->fresh() as $entitlement) {
                 if ($entitlement->updated_at < $freeMonthEnds) {
                     $entitlement->updated_at = $freeMonthEnds;
                     $entitlement->save();
                 }
             }
 
             return 0;
         }
 
         $profit = 0;
         $charges = 0;
         $discount = $this->getDiscountRate();
 
         DB::beginTransaction();
 
         // used to parent individual entitlement billings to the wallet debit.
         $entitlementTransactions = [];
 
         foreach ($this->entitlements()->get()->fresh() as $entitlement) {
             // This entitlement has been created less than or equal to 14 days ago (this is at
             // maximum the fourteenth 24-hour period).
             if ($entitlement->created_at > Carbon::now()->subDays(14)) {
                 continue;
             }
 
             // This entitlement was created, or billed last, less than a month ago.
             if ($entitlement->updated_at > Carbon::now()->subMonthsWithoutOverflow(1)) {
                 continue;
             }
 
             // updated last more than a month ago -- was it billed?
             if ($entitlement->updated_at <= Carbon::now()->subMonthsWithoutOverflow(1)) {
                 $diff = $entitlement->updated_at->diffInMonths(Carbon::now());
 
                 $cost = (int) ($entitlement->cost * $discount * $diff);
                 $fee = (int) ($entitlement->fee * $diff);
 
                 $charges += $cost;
                 $profit += $cost - $fee;
 
                 // if we're in dry-run, you know...
                 if (!$apply) {
                     continue;
                 }
 
                 $entitlement->updated_at = $entitlement->updated_at->copy()
                     ->addMonthsWithoutOverflow($diff);
 
                 $entitlement->save();
 
                 if ($cost == 0) {
                     continue;
                 }
 
                 $entitlementTransactions[] = $entitlement->createTransaction(
                     \App\Transaction::ENTITLEMENT_BILLED,
                     $cost
                 );
             }
         }
 
         if ($apply) {
             $this->debit($charges, '', $entitlementTransactions);
 
             // Credit/debit the reseller
             if ($profit != 0 && $this->owner->tenant) {
                 // FIXME: Should we have a simpler way to skip this for non-reseller tenant(s)
                 if ($wallet = $this->owner->tenant->wallet()) {
                     $desc = "Charged user {$this->owner->email}";
                     $method = $profit > 0 ? 'credit' : 'debit';
                     $wallet->{$method}(abs($profit), $desc);
                 }
             }
         }
 
         DB::commit();
 
         return $charges;
     }
 
     /**
      * Calculate for how long the current balance will last.
      *
      * Returns NULL for balance < 0 or discount = 100% or on a fresh account
      *
      * @return \Carbon\Carbon|null Date
      */
     public function balanceLastsUntil()
     {
         if ($this->balance < 0 || $this->getDiscount() == 100) {
             return null;
         }
 
         // retrieve any expected charges
         $expectedCharge = $this->expectedCharges();
 
         // get the costs per day for all entitlements billed against this wallet
         $costsPerDay = $this->costsPerDay();
 
         if (!$costsPerDay) {
             return null;
         }
 
         // the number of days this balance, minus the expected charges, would last
         $daysDelta = ($this->balance - $expectedCharge) / $costsPerDay;
 
         // calculate from the last entitlement billed
         $entitlement = $this->entitlements()->orderBy('updated_at', 'desc')->first();
 
         $until = $entitlement->updated_at->copy()->addDays($daysDelta);
 
         // Don't return dates from the past
         if ($until < Carbon::now() && !$until->isToday()) {
             return null;
         }
 
         return $until;
     }
 
     /**
      * Controllers of this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
      */
     public function controllers()
     {
         return $this->belongsToMany(
             'App\User',         // The foreign object definition
             'user_accounts',    // The table name
             'wallet_id',      // The local foreign key
             'user_id'         // The remote foreign key
         );
     }
 
     /**
      * Retrieve the costs per day of everything charged to this wallet.
      *
      * @return float
      */
     public function costsPerDay()
     {
         $costs = (float) 0;
 
         foreach ($this->entitlements as $entitlement) {
             $costs += $entitlement->costsPerDay();
         }
 
         return $costs;
     }
 
     /**
      * Add an amount of pecunia to this wallet's balance.
      *
      * @param int    $amount      The amount of pecunia to add (in cents).
      * @param string $description The transaction description
      *
      * @return Wallet Self
      */
     public function credit(int $amount, string $description = ''): Wallet
     {
         $this->balance += $amount;
 
         $this->save();
 
         \App\Transaction::create(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Wallet::class,
                 'type' => \App\Transaction::WALLET_CREDIT,
                 'amount' => $amount,
                 'description' => $description
             ]
         );
 
         return $this;
     }
 
     /**
      * Deduct an amount of pecunia from this wallet's balance.
      *
      * @param int    $amount      The amount of pecunia to deduct (in cents).
      * @param string $description The transaction description
      * @param array  $eTIDs       List of transaction IDs for the individual entitlements
      *                            that make up this debit record, if any.
      * @return Wallet Self
      */
     public function debit(int $amount, string $description = '', array $eTIDs = []): Wallet
     {
         if ($amount == 0) {
             return $this;
         }
 
         $this->balance -= $amount;
 
         $this->save();
 
         $transaction = \App\Transaction::create(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Wallet::class,
                 'type' => \App\Transaction::WALLET_DEBIT,
                 'amount' => $amount * -1,
                 'description' => $description
             ]
         );
 
         if (!empty($eTIDs)) {
             \App\Transaction::whereIn('id', $eTIDs)->update(['transaction_id' => $transaction->id]);
         }
 
         return $this;
     }
 
     /**
      * The discount assigned to the wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function discount()
     {
         return $this->belongsTo('App\Discount', 'discount_id', 'id');
     }
 
     /**
      * Entitlements billed to this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function entitlements()
     {
         return $this->hasMany('App\Entitlement');
     }
 
     /**
      * Calculate the expected charges to this wallet.
      *
      * @return int
      */
     public function expectedCharges()
     {
         return $this->chargeEntitlements(false);
     }
 
     /**
      * Return the exact, numeric version of the discount to be applied.
      *
      * Ranges from 0 - 100.
      *
      * @return int
      */
     public function getDiscount()
     {
         return $this->discount ? $this->discount->discount : 0;
     }
 
     /**
      * The actual discount rate for use in multiplication
      *
      * Ranges from 0.00 to 1.00.
      */
     public function getDiscountRate()
     {
         return (100 - $this->getDiscount()) / 100;
     }
 
     /**
      * A helper to display human-readable amount of money using
      * the wallet currency and specified locale.
      *
      * @param int    $amount A amount of money (in cents)
      * @param string $locale A locale for the output
      *
      * @return string String representation, e.g. "9.99 CHF"
      */
     public function money(int $amount, $locale = 'de_DE')
     {
         $amount = round($amount / 100, 2);
 
         $nf = new \NumberFormatter($locale, \NumberFormatter::CURRENCY);
         $result = $nf->formatCurrency($amount, $this->currency);
         // Replace non-breaking space
         return str_replace("\xC2\xA0", " ", $result);
     }
 
     /**
      * The owner of the wallet -- the wallet is in his/her back pocket.
      *
      * @return \Illuminate\Database\Eloquent\Relations\BelongsTo
      */
     public function owner()
     {
         return $this->belongsTo('App\User', 'user_id', 'id');
     }
 
     /**
      * Payments on this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Relations\HasMany
      */
     public function payments()
     {
         return $this->hasMany('App\Payment');
     }
 
     /**
      * Remove a controller from this wallet.
      *
      * @param \App\User $user The user to remove as a controller from this wallet.
      *
      * @return void
      */
     public function removeController(User $user)
     {
         if ($this->controllers->contains($user)) {
             $this->controllers()->detach($user);
         }
     }
 
-    /**
-     * Any (additional) properties of this wallet.
-     *
-     * @return \Illuminate\Database\Eloquent\Relations\HasMany
-     */
-    public function settings()
-    {
-        return $this->hasMany('App\WalletSetting');
-    }
-
     /**
      * Retrieve the transactions against this wallet.
      *
      * @return \Illuminate\Database\Eloquent\Builder Query builder
      */
     public function transactions()
     {
         return \App\Transaction::where(
             [
                 'object_id' => $this->id,
                 'object_type' => \App\Wallet::class
             ]
         );
     }
 }
diff --git a/src/database/migrations/2021_11_05_100000_create_group_settings_table.php b/src/database/migrations/2021_11_05_100000_create_group_settings_table.php
new file mode 100644
index 00000000..00049197
--- /dev/null
+++ b/src/database/migrations/2021_11_05_100000_create_group_settings_table.php
@@ -0,0 +1,44 @@
+<?php
+
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Database\Migrations\Migration;
+
+// phpcs:ignore
+class CreateGroupSettingsTable extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::create(
+            'group_settings',
+            function (Blueprint $table) {
+                $table->bigIncrements('id');
+                $table->bigInteger('group_id');
+                $table->string('key');
+                $table->text('value');
+                $table->timestamp('created_at')->useCurrent();
+                $table->timestamp('updated_at')->useCurrent();
+
+                $table->foreign('group_id')->references('id')->on('groups')
+                    ->onDelete('cascade')->onUpdate('cascade');
+
+                $table->unique(['group_id', 'key']);
+            }
+        );
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::dropIfExists('group_settings');
+    }
+}
diff --git a/src/resources/lang/en/app.php b/src/resources/lang/en/app.php
index 566723fc..20e06726 100644
--- a/src/resources/lang/en/app.php
+++ b/src/resources/lang/en/app.php
@@ -1,96 +1,97 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Application Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines are used in the application.
     */
 
     'chart-created' => 'Created',
     'chart-deleted' => 'Deleted',
     'chart-average' => 'average',
     'chart-allusers' => 'All Users - last year',
     'chart-discounts' => 'Discounts',
     'chart-vouchers' => 'Vouchers',
     'chart-income' => 'Income in :currency - last 8 weeks',
     'chart-users' => 'Users - last 8 weeks',
 
     'mandate-delete-success' => 'The auto-payment has been removed.',
     'mandate-update-success' => 'The auto-payment has been updated.',
 
     'planbutton' => 'Choose :plan',
 
     'process-async' => 'Setup process has been pushed. Please wait.',
     'process-user-new' => 'Registering a user...',
     'process-user-ldap-ready' => 'Creating a user...',
     'process-user-imap-ready' => 'Creating a mailbox...',
     'process-distlist-new' => 'Registering a distribution list...',
     'process-distlist-ldap-ready' => 'Creating a distribution list...',
     'process-domain-new' => 'Registering a custom domain...',
     'process-domain-ldap-ready' => 'Creating a custom domain...',
     'process-domain-verified' => 'Verifying a custom domain...',
     'process-domain-confirmed' => 'Verifying an ownership of a custom domain...',
     'process-success' => 'Setup process finished successfully.',
     'process-error-user-ldap-ready' => 'Failed to create a user.',
     'process-error-user-imap-ready' => 'Failed to verify that a mailbox exists.',
     'process-error-domain-ldap-ready' => 'Failed to create a domain.',
     'process-error-domain-verified' => 'Failed to verify a domain.',
     'process-error-domain-confirmed' => 'Failed to verify an ownership of a domain.',
     'process-distlist-new' => 'Registering a distribution list...',
     'process-distlist-ldap-ready' => 'Creating a distribution list...',
     'process-error-distlist-ldap-ready' => 'Failed to create a distribution list.',
 
     'distlist-update-success' => 'Distribution list updated successfully.',
     'distlist-create-success' => 'Distribution list created successfully.',
     'distlist-delete-success' => 'Distribution list deleted successfully.',
     'distlist-suspend-success' => 'Distribution list suspended successfully.',
     'distlist-unsuspend-success' => 'Distribution list unsuspended successfully.',
+    'distlist-setconfig-success' => 'Distribution list settings updated successfully.',
 
     'domain-create-success' => 'Domain created successfully.',
     'domain-delete-success' => 'Domain deleted successfully.',
     'domain-notempty-error' => 'Unable to delete a domain with assigned users or other objects.',
     'domain-verify-success' => 'Domain verified successfully.',
     'domain-verify-error' => 'Domain ownership verification failed.',
     'domain-suspend-success' => 'Domain suspended successfully.',
     'domain-unsuspend-success' => 'Domain unsuspended successfully.',
     'domain-setconfig-success' => 'Domain settings updated successfully.',
 
     'user-update-success' => 'User data updated successfully.',
     'user-create-success' => 'User created successfully.',
     'user-delete-success' => 'User deleted successfully.',
     'user-suspend-success' => 'User suspended successfully.',
     'user-unsuspend-success' => 'User unsuspended successfully.',
     'user-reset-2fa-success' => '2-Factor authentication reset successfully.',
     'user-setconfig-success' => 'User settings updated successfully.',
     'user-set-sku-success' => 'The subscription added successfully.',
     'user-set-sku-already-exists' => 'The subscription already exists.',
 
     'search-foundxdomains' => ':x domains have been found.',
     'search-foundxgroups' => ':x distribution lists have been found.',
     'search-foundxusers' => ':x user accounts have been found.',
 
     'signup-invitations-created' => 'The invitation has been created.|:count invitations has been created.',
     'signup-invitations-csv-empty' => 'Failed to find any valid email addresses in the uploaded file.',
     'signup-invitations-csv-invalid-email' => 'Found an invalid email address (:email) on line :line.',
     'signup-invitation-delete-success' => 'Invitation deleted successfully.',
     'signup-invitation-resend-success' => 'Invitation added to the sending queue successfully.',
 
     'support-request-success' => 'Support request submitted successfully.',
     'support-request-error' => 'Failed to submit the support request.',
 
     'siteuser' => ':site User',
 
     'wallet-award-success' => 'The bonus has been added to the wallet successfully.',
     'wallet-penalty-success' => 'The penalty has been added to the wallet successfully.',
     'wallet-update-success' => 'User wallet updated successfully.',
 
     'wallet-notice-date' => 'With your current subscriptions your account balance will last until about :date (:days).',
     'wallet-notice-nocredit' => 'You are out of credit, top up your balance now.',
     'wallet-notice-today' => 'You will run out of credit today, top up your balance now.',
     'wallet-notice-trial' => 'You are in your free trial period.',
     'wallet-notice-trial-end' => 'Your free trial is about to end, top up to continue.',
 ];
diff --git a/src/resources/lang/en/ui.php b/src/resources/lang/en/ui.php
index 41b54ff5..5e7e7514 100644
--- a/src/resources/lang/en/ui.php
+++ b/src/resources/lang/en/ui.php
@@ -1,431 +1,435 @@
 <?php
 
 /**
  * This file will be converted to a Vue-i18n compatible JSON format on build time
  *
  * Note: The Laravel localization features do not work here. Vue-i18n rules are different
  */
 
 return [
 
     'app' => [
         'faq' => "FAQ",
     ],
 
     'btn' => [
         'add' => "Add",
         'accept' => "Accept",
         'back' => "Back",
         'cancel' => "Cancel",
         'close' => "Close",
         'continue' => "Continue",
         'delete' => "Delete",
         'deny' => "Deny",
         'download' => "Download",
         'edit' => "Edit",
         'file' => "Choose file...",
         'moreinfo' => "More information",
         'refresh' => "Refresh",
         'reset' => "Reset",
         'resend' => "Resend",
         'save' => "Save",
         'search' => "Search",
         'signup' => "Sign Up",
         'submit' => "Submit",
         'suspend' => "Suspend",
         'unsuspend' => "Unsuspend",
         'verify' => "Verify",
     ],
 
     'dashboard' => [
         'beta' => "beta",
         'distlists' => "Distribution lists",
         'chat' => "Video chat",
         'domains' => "Domains",
         'invitations' => "Invitations",
         'profile' => "Your profile",
         'users' => "User accounts",
         'wallet' => "Wallet",
         'webmail' => "Webmail",
         'stats' => "Stats",
     ],
 
     'distlist' => [
         'list-title' => "Distribution list | Distribution lists",
         'create' => "Create list",
         'delete' => "Delete list",
         'email' => "Email",
         'list-empty' => "There are no distribution lists in this account.",
         'new' => "New distribution list",
         'recipients' => "Recipients",
+        'sender-policy' => "Sender Access List",
+        'sender-policy-text' => "With this list you can specify who can send mail to the distribution list."
+            . " You can put a complete email address (jane@kolab.org), domain (kolab.org) or suffix (.org) that the sender email address is compared to."
+            . " If the list is empty, mail from anyone is allowed.",
     ],
 
     'domain' => [
         'delete' => "Delete domain",
         'delete-domain' => "Delete {domain}",
         'delete-text' => "Do you really want to delete this domain permanently?"
             . " This is only possible if there are no users, aliases or other objects in this domain."
             . " Please note that this action cannot be undone.",
         'dns-verify' => "Domain DNS verification sample:",
         'dns-config' => "Domain DNS configuration sample:",
         'namespace' => "Namespace",
         'spf-whitelist' => "SPF Whitelist",
         'spf-whitelist-text' => "The Sender Policy Framework allows a sender domain to disclose, through DNS, "
             . "which systems are allowed to send emails with an envelope sender address within said domain.",
         'spf-whitelist-ex' => "Here you can specify a list of allowed servers, for example: <var>.ess.barracuda.com</var>.",
         'verify' => "Domain verification",
         'verify-intro' => "In order to confirm that you're the actual holder of the domain, we need to run a verification process before finally activating it for email delivery.",
         'verify-dns' => "The domain <b>must have one of the following entries</b> in DNS:",
         'verify-dns-txt' => "TXT entry with value:",
         'verify-dns-cname' => "or CNAME entry:",
         'verify-outro' => "When this is done press the button below to start the verification.",
         'verify-sample' => "Here's a sample zone file for your domain:",
         'config' => "Domain configuration",
         'config-intro' => "In order to let {app} receive email traffic for your domain you need to adjust the DNS settings, more precisely the MX entries, accordingly.",
         'config-sample' => "Edit your domain's zone file and replace existing MX entries with the following values:",
         'config-hint' => "If you don't know how to set DNS entries for your domain, please contact the registration service where you registered the domain or your web hosting provider.",
         'create' => "Create domain",
         'new' => "New domain",
     ],
 
     'error' => [
         '400' => "Bad request",
         '401' => "Unauthorized",
         '403' => "Access denied",
         '404' => "Not found",
         '405' => "Method not allowed",
         '500' => "Internal server error",
         'unknown' => "Unknown Error",
         'server' => "Server Error",
         'form' => "Form validation error",
     ],
 
     'form' => [
         'amount' => "Amount",
         'code' => "Confirmation Code",
         'config' => "Configuration",
         'date' => "Date",
         'description' => "Description",
         'details' => "Details",
         'disabled' => "disabled",
         'domain' => "Domain",
         'email' => "Email Address",
         'enabled' => "enabled",
         'firstname' => "First Name",
         'general' => "General",
         'lastname' => "Last Name",
         'none' => "none",
         'or' => "or",
         'password' => "Password",
         'password-confirm' => "Confirm Password",
         'phone' => "Phone",
         'settings' => "Settings",
         'status' => "Status",
         'surname' => "Surname",
         'user' => "User",
         'primary-email' => "Primary Email",
         'id' => "ID",
         'created' => "Created",
         'deleted' => "Deleted",
     ],
 
     'invitation' => [
         'create' => "Create invite(s)",
         'create-title' => "Invite for a signup",
         'create-email' => "Enter an email address of the person you want to invite.",
         'create-csv' => "To send multiple invitations at once, provide a CSV (comma separated) file, or alternatively a plain-text file, containing one email address per line.",
         'empty-list' => "There are no invitations in the database.",
         'title' => "Signup invitations",
         'search' => "Email address or domain",
         'send' => "Send invite(s)",
         'status-completed' => "User signed up",
         'status-failed' => "Sending failed",
         'status-sent' => "Sent",
         'status-new' => "Not sent yet",
     ],
 
     'lang' => [
         'en' => "English",
         'de' => "German",
         'fr' => "French",
         'it' => "Italian",
     ],
 
     'login' => [
         '2fa' => "Second factor code",
         '2fa_desc' => "Second factor code is optional for users with no 2-Factor Authentication setup.",
         'forgot_password' => "Forgot password?",
         'header' => "Please sign in",
         'sign_in' => "Sign in",
         'webmail' => "Webmail"
     ],
 
     'meet' => [
         'title' => "Voice & Video Conferencing",
         'welcome' => "Welcome to our beta program for Voice & Video Conferencing.",
         'url' => "You have a room of your own at the URL below. This room is only open when you yourself are in attendance. Use this URL to invite people to join you.",
         'notice' => "This is a work in progress and more features will be added over time. Current features include:",
         'sharing' => "Screen Sharing",
         'sharing-text' => "Share your screen for presentations or show-and-tell.",
         'security' => "Room Security",
         'security-text' => "Increase the room security by setting a password that attendees will need to know"
             . " before they can enter, or lock the door so attendees will have to knock, and a moderator can accept or deny those requests.",
         'qa' => "Raise Hand (Q&A)",
         'qa-text' => "Silent audience members can raise their hand to facilitate a Question & Answer session with the panel members.",
         'moderation' => "Moderator Delegation",
         'moderation-text' => "Delegate moderator authority for the session, so that a speaker is not needlessly"
             . " interrupted with attendees knocking and other moderator duties.",
         'eject' => "Eject Attendees",
         'eject-text' => "Eject attendees from the session in order to force them to reconnect, or address policy"
             . " violations. Click the user icon for effective dismissal.",
         'silent' => "Silent Audience Members",
         'silent-text' => "For a webinar-style session, configure the room to force all new attendees to be silent audience members.",
         'interpreters' => "Language Specific Audio Channels",
         'interpreters-text' => "Designate a participant to interpret the original audio to a target language, for sessions"
             . " with multi-lingual attendees. The interpreter is expected to be able to relay the original audio, and override it.",
         'beta-notice' => "Keep in mind that this is still in beta and might come with some issues."
             . " Should you encounter any on your way, let us know by contacting support.",
 
         // Room options dialog
         'options' => "Room options",
         'password' => "Password",
         'password-none' => "none",
         'password-clear' => "Clear password",
         'password-set' => "Set password",
         'password-text' => "You can add a password to your meeting. Participants will have to provide the password before they are allowed to join the meeting.",
         'lock' => "Locked room",
         'lock-text' => "When the room is locked participants have to be approved by a moderator before they could join the meeting.",
         'nomedia' => "Subscribers only",
         'nomedia-text' => "Forces all participants to join as subscribers (with camera and microphone turned off)."
             . " Moderators will be able to promote them to publishers throughout the session.",
 
         // Room menu
         'partcnt' => "Number of participants",
         'menu-audio-mute' => "Mute audio",
         'menu-audio-unmute' => "Unmute audio",
         'menu-video-mute' => "Mute video",
         'menu-video-unmute' => "Unmute video",
         'menu-screen' => "Share screen",
         'menu-hand-lower' => "Lower hand",
         'menu-hand-raise' => "Raise hand",
         'menu-channel' => "Interpreted language channel",
         'menu-chat' => "Chat",
         'menu-fullscreen' => "Full screen",
         'menu-fullscreen-exit' => "Exit full screen",
         'menu-leave' => "Leave session",
 
         // Room setup screen
         'setup-title' => "Set up your session",
         'mic' => "Microphone",
         'cam' => "Camera",
         'nick' => "Nickname",
         'nick-placeholder' => "Your name",
         'join' => "JOIN",
         'joinnow' => "JOIN NOW",
         'imaowner' => "I'm the owner",
 
         // Room
         'qa' => "Q & A",
         'leave-title' => "Room closed",
         'leave-body' => "The session has been closed by the room owner.",
         'media-title' => "Media setup",
         'join-request' => "Join request",
         'join-requested' => "{user} requested to join.",
 
         // Status messages
         'status-init' => "Checking the room...",
         'status-323' => "The room is closed. Please, wait for the owner to start the session.",
         'status-324' => "The room is closed. It will be open for others after you join.",
         'status-325' => "The room is ready. Please, provide a valid password.",
         'status-326' => "The room is locked. Please, enter your name and try again.",
         'status-327' => "Waiting for permission to join the room.",
         'status-404' => "The room does not exist.",
         'status-429' => "Too many requests. Please, wait.",
         'status-500' => "Failed to connect to the room. Server error.",
 
         // Other menus
         'media-setup' => "Media setup",
         'perm' => "Permissions",
         'perm-av' => "Audio &amp; Video publishing",
         'perm-mod' => "Moderation",
         'lang-int' => "Language interpreter",
         'menu-options' => "Options",
     ],
 
     'menu' => [
         'cockpit' => "Cockpit",
         'login' => "Login",
         'logout' => "Logout",
         'signup' => "Signup",
         'toggle' => "Toggle navigation",
     ],
 
     'msg' => [
         'initializing' => "Initializing...",
         'loading' => "Loading...",
         'loading-failed' => "Failed to load data.",
         'notfound' => "Resource not found.",
         'info' => "Information",
         'error' => "Error",
         'warning' => "Warning",
         'success' => "Success",
     ],
 
     'nav' => [
         'more' => "Load more",
         'step' => "Step {i}/{n}",
     ],
 
     'password' => [
         'reset' => "Password Reset",
         'reset-step1' => "Enter your email address to reset your password.",
         'reset-step1-hint' => "You may need to check your spam folder or unblock {email}.",
         'reset-step2' => "We sent out a confirmation code to your external email address."
             . " Enter the code we sent you, or click the link in the message.",
     ],
 
     'signup' => [
         'email' => "Existing Email Address",
         'login' => "Login",
         'title' => "Sign Up",
         'step1' => "Sign up to start your free month.",
         'step2' => "We sent out a confirmation code to your email address. Enter the code we sent you, or click the link in the message.",
         'step3' => "Create your Kolab identity (you can choose additional addresses later).",
         'voucher' => "Voucher Code",
     ],
 
     'status' => [
         'prepare-account' => "We are preparing your account.",
         'prepare-domain' => "We are preparing the domain.",
         'prepare-distlist' => "We are preparing the distribution list.",
         'prepare-user' => "We are preparing the user account.",
         'prepare-hint' => "Some features may be missing or readonly at the moment.",
         'prepare-refresh' => "The process never ends? Press the \"Refresh\" button, please.",
         'ready-account' => "Your account is almost ready.",
         'ready-domain' => "The domain is almost ready.",
         'ready-distlist' => "The distribution list is almost ready.",
         'ready-user' => "The user account is almost ready.",
         'verify' => "Verify your domain to finish the setup process.",
         'verify-domain' => "Verify domain",
         'deleted' => "Deleted",
         'suspended' => "Suspended",
         'notready' => "Not Ready",
         'active' => "Active",
     ],
 
     'support' => [
         'title' => "Contact Support",
         'id' => "Customer number or email address you have with us",
         'id-pl' => "e.g. 12345678 or john@kolab.org",
         'id-hint' => "Leave blank if you are not a customer yet",
         'name' => "Name",
         'name-pl' => "how we should call you in our reply",
         'email' => "Working email address",
         'email-pl' => "make sure we can reach you at this address",
         'summary' => "Issue Summary",
         'summary-pl' => "one sentence that summarizes your issue",
         'expl' => "Issue Explanation",
     ],
 
     'user' => [
         '2fa-hint1' => "This will remove 2-Factor Authentication entitlement as well as the user-configured factors.",
         '2fa-hint2' => "Please, make sure to confirm the user identity properly.",
         'add-beta' => "Enable beta program",
         'address' => "Address",
         'aliases' => "Aliases",
         'aliases-email' => "Email Aliases",
         'aliases-none' => "This user has no email aliases.",
         'add-bonus' => "Add bonus",
         'add-bonus-title' => "Add a bonus to the wallet",
         'add-penalty' => "Add penalty",
         'add-penalty-title' => "Add a penalty to the wallet",
         'auto-payment' => "Auto-payment",
         'auto-payment-text' => "Fill up by <b>{amount}</b> when under <b>{balance}</b> using {method}",
         'country' => "Country",
         'create' => "Create user",
         'custno' => "Customer No.",
         'delete' => "Delete user",
         'delete-account' => "Delete this account?",
         'delete-email' => "Delete {email}",
         'delete-text' => "Do you really want to delete this user permanently?"
             . " This will delete all account data and withdraw the permission to access the email account."
             . " Please note that this action cannot be undone.",
         'discount' => "Discount",
         'discount-hint' => "applied discount",
         'discount-title' => "Account discount",
         'distlists' => "Distribution lists",
         'distlists-none' => "There are no distribution lists in this account.",
         'domains' => "Domains",
         'domains-none' => "There are no domains in this account.",
         'ext-email' => "External Email",
         'finances' => "Finances",
         'greylisting' => "Greylisting",
         'greylisting-text' => "Greylisting is a method of defending users against spam. Any incoming mail from an unrecognized sender "
             . "is temporarily rejected. The originating server should try again after a delay. "
             . "This time the email will be accepted. Spammers usually do not reattempt mail delivery.",
         'list-title' => "User accounts",
         'managed-by' => "Managed by",
         'new' => "New user account",
         'org' => "Organization",
         'package' => "Package",
         'price' => "Price",
         'profile-title' => "Your profile",
         'profile-delete' => "Delete account",
         'profile-delete-title' => "Delete this account?",
         'profile-delete-text1' => "This will delete the account as well as all domains, users and aliases associated with this account.",
         'profile-delete-warning' => "This operation is irreversible",
         'profile-delete-text2' => "As you will not be able to recover anything after this point, please make sure that you have migrated all data before proceeding.",
         'profile-delete-support' => "As we always strive to improve, we would like to ask for 2 minutes of your time. "
             . "The best tool for improvement is feedback from users, and we would like to ask "
             . "for a few words about your reasons for leaving our service. Please send your feedback to <a href=\"{href}\">{email}</a>.",
         'profile-delete-contact' => "Also feel free to contact {app} Support with any questions or concerns that you may have in this context.",
         'reset-2fa' => "Reset 2-Factor Auth",
         'reset-2fa-title' => "2-Factor Authentication Reset",
         'title' => "User account",
         'search' => "User email address or name",
         'search-pl' => "User ID, email or domain",
         'skureq' => "{sku} requires {list}.",
         'subscription' => "Subscription",
         'subscriptions' => "Subscriptions",
         'subscriptions-none' => "This user has no subscriptions.",
         'users' => "Users",
         'users-none' => "There are no users in this account.",
     ],
 
     'wallet' => [
         'add-credit' => "Add credit",
         'auto-payment-cancel' => "Cancel auto-payment",
         'auto-payment-change' => "Change auto-payment",
         'auto-payment-failed' => "The setup of automatic payments failed. Restart the process to enable automatic top-ups.",
         'auto-payment-hint' => "Here is how it works: Every time your account runs low, we will charge your preferred payment method for an amount you choose."
             . " You can cancel or change the auto-payment option at any time.",
         'auto-payment-setup' => "Set up auto-payment",
         'auto-payment-disabled' => "The configured auto-payment has been disabled. Top up your wallet or raise the auto-payment amount.",
         'auto-payment-info' => "Auto-payment is <b>set</b> to fill up your account by <b>{amount}</b> every time your account balance gets under <b>{balance}</b>.",
         'auto-payment-inprogress' => "The setup of the automatic payment is still in progress.",
         'auto-payment-next' => "Next, you will be redirected to the checkout page, where you can provide your credit card details.",
         'auto-payment-disabled-next' => "The auto-payment is disabled. Immediately after you submit new settings we'll enable it and attempt to top up your wallet.",
         'auto-payment-update' => "Update auto-payment",
         'banktransfer-hint' => "Please note that a bank transfer can take several days to complete.",
         'currency-conv' => "Here is how it works: You specify the amount by which you want to top up your wallet in {wc}."
             . " We will then convert this to {pc}, and on the next page you will be provided with the bank-details to transfer the amount in {pc}.",
         'fill-up' => "Fill up by",
         'history' => "History",
         'month' => "month",
         'noperm' => "Only account owners can access a wallet.",
         'payment-amount-hint' => "Choose the amount by which you want to top up your wallet.",
         'payment-method' => "Method of payment: {method}",
         'payment-warning' => "You will be charged for {price}.",
         'pending-payments' => "Pending Payments",
         'pending-payments-warning' => "You have payments that are still in progress. See the \"Pending Payments\" tab below.",
         'pending-payments-none' => "There are no pending payments for this account.",
         'receipts' => "Receipts",
         'receipts-hint' => "Here you can download receipts (in PDF format) for payments in specified period. Select the period and press the Download button.",
         'receipts-none' => "There are no receipts for payments in this account. Please, note that you can download receipts after the month ends.",
         'title' => "Account balance",
         'top-up' => "Top up your wallet",
         'transactions' => "Transactions",
         'transactions-none' => "There are no transactions for this account.",
         'when-below' => "when account balance is below",
     ],
 ];
diff --git a/src/resources/lang/en/validation.php b/src/resources/lang/en/validation.php
index b61d95db..9cd67c45 100644
--- a/src/resources/lang/en/validation.php
+++ b/src/resources/lang/en/validation.php
@@ -1,173 +1,174 @@
 <?php
 
 return [
 
     /*
     |--------------------------------------------------------------------------
     | Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | The following language lines contain the default error messages used by
     | the validator class. Some of these rules have multiple versions such
     | as the size rules. Feel free to tweak each of these messages here.
     |
     */
 
     'accepted' => 'The :attribute must be accepted.',
     'active_url' => 'The :attribute is not a valid URL.',
     'after' => 'The :attribute must be a date after :date.',
     'after_or_equal' => 'The :attribute must be a date after or equal to :date.',
     'alpha' => 'The :attribute may only contain letters.',
     'alpha_dash' => 'The :attribute may only contain letters, numbers, dashes and underscores.',
     'alpha_num' => 'The :attribute may only contain letters and numbers.',
     'array' => 'The :attribute must be an array.',
     'before' => 'The :attribute must be a date before :date.',
     'before_or_equal' => 'The :attribute must be a date before or equal to :date.',
     'between' => [
         'numeric' => 'The :attribute must be between :min and :max.',
         'file' => 'The :attribute must be between :min and :max kilobytes.',
         'string' => 'The :attribute must be between :min and :max characters.',
         'array' => 'The :attribute must have between :min and :max items.',
     ],
     'boolean' => 'The :attribute field must be true or false.',
     'confirmed' => 'The :attribute confirmation does not match.',
     'date' => 'The :attribute is not a valid date.',
     'date_equals' => 'The :attribute must be a date equal to :date.',
     'date_format' => 'The :attribute does not match the format :format.',
     'different' => 'The :attribute and :other must be different.',
     'digits' => 'The :attribute must be :digits digits.',
     'digits_between' => 'The :attribute must be between :min and :max digits.',
     'dimensions' => 'The :attribute has invalid image dimensions.',
     'distinct' => 'The :attribute field has a duplicate value.',
     'email' => 'The :attribute must be a valid email address.',
     'ends_with' => 'The :attribute must end with one of the following: :values',
     'exists' => 'The selected :attribute is invalid.',
     'file' => 'The :attribute must be a file.',
     'filled' => 'The :attribute field must have a value.',
     'gt' => [
         'numeric' => 'The :attribute must be greater than :value.',
         'file' => 'The :attribute must be greater than :value kilobytes.',
         'string' => 'The :attribute must be greater than :value characters.',
         'array' => 'The :attribute must have more than :value items.',
     ],
     'gte' => [
         'numeric' => 'The :attribute must be greater than or equal :value.',
         'file' => 'The :attribute must be greater than or equal :value kilobytes.',
         'string' => 'The :attribute must be greater than or equal :value characters.',
         'array' => 'The :attribute must have :value items or more.',
     ],
     'image' => 'The :attribute must be an image.',
     'in' => 'The selected :attribute is invalid.',
     'in_array' => 'The :attribute field does not exist in :other.',
     'integer' => 'The :attribute must be an integer.',
     'ip' => 'The :attribute must be a valid IP address.',
     'ipv4' => 'The :attribute must be a valid IPv4 address.',
     'ipv6' => 'The :attribute must be a valid IPv6 address.',
     'json' => 'The :attribute must be a valid JSON string.',
     'lt' => [
         'numeric' => 'The :attribute must be less than :value.',
         'file' => 'The :attribute must be less than :value kilobytes.',
         'string' => 'The :attribute must be less than :value characters.',
         'array' => 'The :attribute must have less than :value items.',
     ],
     'lte' => [
         'numeric' => 'The :attribute must be less than or equal :value.',
         'file' => 'The :attribute must be less than or equal :value kilobytes.',
         'string' => 'The :attribute must be less than or equal :value characters.',
         'array' => 'The :attribute must not have more than :value items.',
     ],
     'max' => [
         'numeric' => 'The :attribute may not be greater than :max.',
         'file' => 'The :attribute may not be greater than :max kilobytes.',
         'string' => 'The :attribute may not be greater than :max characters.',
         'array' => 'The :attribute may not have more than :max items.',
     ],
     'mimes' => 'The :attribute must be a file of type: :values.',
     'mimetypes' => 'The :attribute must be a file of type: :values.',
     'min' => [
         'numeric' => 'The :attribute must be at least :min.',
         'file' => 'The :attribute must be at least :min kilobytes.',
         'string' => 'The :attribute must be at least :min characters.',
         'array' => 'The :attribute must have at least :min items.',
     ],
     'not_in' => 'The selected :attribute is invalid.',
     'not_regex' => 'The :attribute format is invalid.',
     'numeric' => 'The :attribute must be a number.',
     'present' => 'The :attribute field must be present.',
     'regex' => 'The :attribute format is invalid.',
     'required' => 'The :attribute field is required.',
     'required_if' => 'The :attribute field is required when :other is :value.',
     'required_unless' => 'The :attribute field is required unless :other is in :values.',
     'required_with' => 'The :attribute field is required when :values is present.',
     'required_with_all' => 'The :attribute field is required when :values are present.',
     'required_without' => 'The :attribute field is required when :values is not present.',
     'required_without_all' => 'The :attribute field is required when none of :values are present.',
     'same' => 'The :attribute and :other must match.',
     'size' => [
         'numeric' => 'The :attribute must be :size.',
         'file' => 'The :attribute must be :size kilobytes.',
         'string' => 'The :attribute must be :size characters.',
         'array' => 'The :attribute must contain :size items.',
     ],
     'starts_with' => 'The :attribute must start with one of the following: :values',
     'string' => 'The :attribute must be a string.',
     'timezone' => 'The :attribute must be a valid zone.',
     'unique' => 'The :attribute has already been taken.',
     'uploaded' => 'The :attribute failed to upload.',
     'url' => 'The :attribute format is invalid.',
     'uuid' => 'The :attribute must be a valid UUID.',
 
     '2fareq' => 'Second factor code is required.',
     '2fainvalid' => 'Second factor code is invalid.',
     'emailinvalid' => 'The specified email address is invalid.',
     'domaininvalid' => 'The specified domain is invalid.',
     'domainnotavailable' => 'The specified domain is not available.',
     'logininvalid' => 'The specified login is invalid.',
     'loginexists' => 'The specified login is not available.',
     'domainexists' => 'The specified domain is not available.',
     'noemailorphone' => 'The specified text is neither a valid email address nor a phone number.',
     'packageinvalid' => 'Invalid package selected.',
     'packagerequired' => 'Package is required.',
     'usernotexists' => 'Unable to find user.',
     'voucherinvalid' => 'The voucher code is invalid or expired.',
     'noextemail' => 'This user has no external email address.',
     'entryinvalid' => 'The specified :attribute is invalid.',
     'entryexists' => 'The specified :attribute is not available.',
     'minamount' => 'Minimum amount for a single payment is :amount.',
     'minamountdebt' => 'The specified amount does not cover the balance on the account.',
     'notalocaluser' => 'The specified email address does not exist.',
     'memberislist' => 'A recipient cannot be the same as the list address.',
     'listmembersrequired' => 'At least one recipient is required.',
     'spf-entry-invalid' => 'The entry format is invalid. Expected a domain name starting with a dot.',
+    'sp-entry-invalid' => 'The entry format is invalid. Expected an email, domain, or part of it.',
     'invalid-config-parameter' => 'The requested configuration parameter is not supported.',
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Language Lines
     |--------------------------------------------------------------------------
     |
     | Here you may specify custom validation messages for attributes using the
     | convention "attribute.rule" to name the lines. This makes it quick to
     | specify a specific custom language line for a given attribute rule.
     |
     */
 
     'custom' => [
         'attribute-name' => [
             'rule-name' => 'custom-message',
         ],
     ],
 
     /*
     |--------------------------------------------------------------------------
     | Custom Validation Attributes
     |--------------------------------------------------------------------------
     |
     | The following language lines are used to swap our attribute placeholder
     | with something more reader friendly such as "E-Mail Address" instead
     | of "email". This simply helps us make our message more expressive.
     |
     */
 
     'attributes' => [],
 ];
diff --git a/src/resources/vue/Admin/Distlist.vue b/src/resources/vue/Admin/Distlist.vue
index 4f20a308..c28ba5e5 100644
--- a/src/resources/vue/Admin/Distlist.vue
+++ b/src/resources/vue/Admin/Distlist.vue
@@ -1,85 +1,110 @@
 <template>
     <div v-if="list.id" class="container">
         <div class="card" id="distlist-info">
             <div class="card-body">
                 <div class="card-title">{{ list.email }}</div>
                 <div class="card-text">
                     <form class="read-only short">
                         <div class="row plaintext">
                             <label for="distlistid" class="col-sm-4 col-form-label">
                                 {{ $t('form.id') }} <span class="text-muted">({{ $t('form.created') }})</span>
                             </label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="distlistid">
                                     {{ list.id }} <span class="text-muted">({{ list.created_at }})</span>
                                 </span>
                             </div>
                         </div>
                         <div class="row plaintext">
                             <label for="status" class="col-sm-4 col-form-label">{{ $t('form.status') }}</label>
                             <div class="col-sm-8">
                                 <span :class="$root.distlistStatusClass(list) + ' form-control-plaintext'" id="status">{{ $root.distlistStatusText(list) }}</span>
                             </div>
                         </div>
                         <div class="row plaintext">
-                            <label for="members-input" class="col-sm-4 col-form-label">{{ $t('distlist.recipients') }}</label>
+                            <label for="members" class="col-sm-4 col-form-label">{{ $t('distlist.recipients') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="members">
                                     <span v-for="member in list.members" :key="member">{{ member }}<br></span>
                                 </span>
                             </div>
                         </div>
                     </form>
                     <div class="mt-2">
                         <button v-if="!list.isSuspended" id="button-suspend" class="btn btn-warning" type="button" @click="suspendList">
                             {{ $t('btn.suspend') }}
                         </button>
                         <button v-if="list.isSuspended" id="button-unsuspend" class="btn btn-warning" type="button" @click="unsuspendList">
                             {{ $t('btn.unsuspend') }}
                         </button>
                     </div>
                 </div>
             </div>
         </div>
+        <ul class="nav nav-tabs mt-3" role="tablist">
+            <li class="nav-item">
+                <a class="nav-link active" id="tab-settings" href="#distlist-settings" role="tab" aria-controls="distlist-settings" aria-selected="false" @click="$root.tab">
+                    {{ $t('form.settings') }}
+                </a>
+            </li>
+        </ul>
+        <div class="tab-content">
+            <div class="tab-pane show active" id="distlist-settings" role="tabpanel" aria-labelledby="tab-settings">
+                <div class="card-body">
+                    <div class="card-text">
+                        <form class="read-only short">
+                            <div class="row plaintext">
+                                <label for="sender_policy" class="col-sm-4 col-form-label">{{ $t('distlist.sender-policy') }}</label>
+                                <div class="col-sm-8">
+                                    <span class="form-control-plaintext" id="sender_policy">
+                                        {{ list.config.sender_policy && list.config.sender_policy.length ? list.config.sender_policy.join(', ') : $t('form.none') }}
+                                    </span>
+                                </div>
+                            </div>
+                        </form>
+                    </div>
+                </div>
+            </div>
+        </div>
     </div>
 </template>
 
 <script>
     export default {
         data() {
             return {
-                list: { members: [] }
+                list: { members: [], config: {} }
             }
         },
         created() {
             this.$root.startLoading()
 
             axios.get('/api/v4/groups/' + this.$route.params.list)
                 .then(response => {
                     this.$root.stopLoading()
                     this.list = response.data
                 })
                 .catch(this.$root.errorHandler)
         },
         methods: {
             suspendList() {
                 axios.post('/api/v4/groups/' + this.list.id + '/suspend', {})
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.list = Object.assign({}, this.list, { isSuspended: true })
                         }
                     })
             },
             unsuspendList() {
                 axios.post('/api/v4/groups/' + this.list.id + '/unsuspend', {})
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.list = Object.assign({}, this.list, { isSuspended: false })
                         }
                     })
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Admin/Domain.vue b/src/resources/vue/Admin/Domain.vue
index d92909ef..725f68d7 100644
--- a/src/resources/vue/Admin/Domain.vue
+++ b/src/resources/vue/Admin/Domain.vue
@@ -1,118 +1,118 @@
 <template>
     <div v-if="domain" class="container">
         <div class="card" id="domain-info">
             <div class="card-body">
                 <div class="card-title">{{ domain.namespace }}</div>
                 <div class="card-text">
                     <form class="read-only short">
                         <div class="row plaintext">
                             <label for="domainid" class="col-sm-4 col-form-label">
                                 {{ $t('form.id') }} <span class="text-muted">({{ $t('form.created') }})</span>
                             </label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="domainid">
                                     {{ domain.id }} <span class="text-muted">({{ domain.created_at }})</span>
                                 </span>
                             </div>
                         </div>
                         <div class="row plaintext">
                             <label for="first_name" class="col-sm-4 col-form-label">{{ $t('form.status') }}</label>
                             <div class="col-sm-8">
                                 <span class="form-control-plaintext" id="status">
                                     <span :class="$root.domainStatusClass(domain)">{{ $root.domainStatusText(domain) }}</span>
                                 </span>
                             </div>
                         </div>
                     </form>
                     <div class="mt-2">
                         <button v-if="!domain.isSuspended" id="button-suspend" class="btn btn-warning" type="button" @click="suspendDomain">
                             {{ $t('btn.suspend') }}
                         </button>
                         <button v-if="domain.isSuspended" id="button-unsuspend" class="btn btn-warning" type="button" @click="unsuspendDomain">
                             {{ $t('btn.unsuspend') }}
                         </button>
                     </div>
                 </div>
             </div>
         </div>
         <ul class="nav nav-tabs mt-3" role="tablist">
             <li class="nav-item">
                 <a class="nav-link active" id="tab-config" href="#domain-config" role="tab" aria-controls="domain-config" aria-selected="true" @click="$root.tab">
                     {{ $t('form.config') }}
                 </a>
             </li>
             <li class="nav-item">
                 <a class="nav-link" id="tab-settings" href="#domain-settings" role="tab" aria-controls="domain-settings" aria-selected="false" @click="$root.tab">
                     {{ $t('form.settings') }}
                 </a>
             </li>
         </ul>
         <div class="tab-content">
             <div class="tab-pane show active" id="domain-config" role="tabpanel" aria-labelledby="tab-config">
                 <div class="card-body">
                     <div class="card-text">
                         <p>{{ $t('domain.dns-verify') }}</p>
                         <p><pre id="dns-verify">{{ domain.dns.join("\n") }}</pre></p>
                         <p>{{ $t('domain.dns-config') }}</p>
                         <p><pre id="dns-config">{{ domain.mx.join("\n") }}</pre></p>
                     </div>
                 </div>
             </div>
             <div class="tab-pane" id="domain-settings" role="tabpanel" aria-labelledby="tab-settings">
                 <div class="card-body">
                     <div class="card-text">
                         <form class="read-only short">
                             <div class="row plaintext">
                                 <label for="spf_whitelist" class="col-sm-4 col-form-label">{{ $t('domain.spf-whitelist') }}</label>
                                 <div class="col-sm-8">
                                     <span class="form-control-plaintext" id="spf_whitelist">
-                                        {{ domain.config && domain.config.spf_whitelist.length ? domain.config.spf_whitelist.join(', ') : 'none' }}
+                                        {{ domain.config && domain.config.spf_whitelist.length ? domain.config.spf_whitelist.join(', ') : $t('form.none') }}
                                     </span>
                                 </div>
                             </div>
                         </form>
                     </div>
                 </div>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     export default {
         data() {
             return {
                 domain: null
             }
         },
         created() {
             const domain_id = this.$route.params.domain;
 
             axios.get('/api/v4/domains/' + domain_id)
                 .then(response => {
                     this.domain = response.data
                 })
                 .catch(this.$root.errorHandler)
         },
         methods: {
             suspendDomain() {
                 axios.post('/api/v4/domains/' + this.domain.id + '/suspend', {})
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.domain = Object.assign({}, this.domain, { isSuspended: true })
                         }
                     })
             },
             unsuspendDomain() {
                 axios.post('/api/v4/domains/' + this.domain.id + '/unsuspend', {})
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.domain = Object.assign({}, this.domain, { isSuspended: false })
                         }
                     })
             }
         }
     }
 </script>
diff --git a/src/resources/vue/Distlist/Info.vue b/src/resources/vue/Distlist/Info.vue
index 4505f9b4..99899f5b 100644
--- a/src/resources/vue/Distlist/Info.vue
+++ b/src/resources/vue/Distlist/Info.vue
@@ -1,105 +1,144 @@
 <template>
     <div class="container">
         <status-component v-if="list_id !== 'new'" :status="status" @status-update="statusUpdate"></status-component>
 
         <div class="card" id="distlist-info">
             <div class="card-body">
                 <div class="card-title" v-if="list_id !== 'new'">
                     {{ $tc('distlist.list-title', 1) }}
                     <button class="btn btn-outline-danger button-delete float-end" @click="deleteList()" tag="button">
                         <svg-icon icon="trash-alt"></svg-icon> {{ $t('distlist.delete') }}
                     </button>
                 </div>
                 <div class="card-title" v-if="list_id === 'new'">{{ $t('distlist.new') }}</div>
                 <div class="card-text">
-                    <form @submit.prevent="submit">
-                        <div v-if="list_id !== 'new'" class="row plaintext mb-3">
-                            <label for="status" class="col-sm-4 col-form-label">{{ $t('form.status') }}</label>
-                            <div class="col-sm-8">
-                                <span :class="$root.distlistStatusClass(list) + ' form-control-plaintext'" id="status">{{ $root.distlistStatusText(list) }}</span>
-                            </div>
+                    <ul class="nav nav-tabs mt-3" role="tablist">
+                        <li class="nav-item">
+                            <a class="nav-link active" id="tab-general" href="#general" role="tab" aria-controls="general" aria-selected="true" @click="$root.tab">
+                                {{ $t('form.general') }}
+                            </a>
+                        </li>
+                        <li v-if="list_id !== 'new'" class="nav-item">
+                            <a class="nav-link" id="tab-settings" href="#settings" role="tab" aria-controls="settings" aria-selected="false" @click="$root.tab">
+                                {{ $t('form.settings') }}
+                            </a>
+                        </li>
+                    </ul>
+                    <div class="tab-content">
+                        <div class="tab-pane show active" id="general" role="tabpanel" aria-labelledby="tab-general">
+                            <form @submit.prevent="submit" class="card-body">
+                                <div v-if="list_id !== 'new'" class="row plaintext mb-3">
+                                    <label for="status" class="col-sm-4 col-form-label">{{ $t('form.status') }}</label>
+                                    <div class="col-sm-8">
+                                        <span :class="$root.distlistStatusClass(list) + ' form-control-plaintext'" id="status">{{ $root.distlistStatusText(list) }}</span>
+                                    </div>
+                                </div>
+                                <div class="row mb-3">
+                                    <label for="email" class="col-sm-4 col-form-label">{{ $t('form.email') }}</label>
+                                    <div class="col-sm-8">
+                                        <input type="text" class="form-control" id="email" :disabled="list_id !== 'new'" required v-model="list.email">
+                                    </div>
+                                </div>
+                                <div class="row mb-3">
+                                    <label for="members-input" class="col-sm-4 col-form-label">{{ $t('distlist.recipients') }}</label>
+                                    <div class="col-sm-8">
+                                        <list-input id="members" :list="list.members"></list-input>
+                                    </div>
+                                </div>
+                                <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}</button>
+                            </form>
                         </div>
-                        <div class="row mb-3">
-                            <label for="email" class="col-sm-4 col-form-label">{{ $t('form.email') }}</label>
-                            <div class="col-sm-8">
-                                <input type="text" class="form-control" id="email" :disabled="list_id !== 'new'" required v-model="list.email">
-                            </div>
+                        <div class="tab-pane" id="settings" role="tabpanel" aria-labelledby="tab-settings">
+                            <form @submit.prevent="submitSettings" class="card-body">
+                                <div class="row checkbox mb-3">
+                                    <label for="sender-policy-input" class="col-sm-4 col-form-label">{{ $t('distlist.sender-policy') }}</label>
+                                    <div class="col-sm-8 pt-2">
+                                        <list-input id="sender-policy" :list="list.config.sender_policy"></list-input>
+                                        <small id="sender-policy-hint" class="text-muted">
+                                            {{ $t('distlist.sender-policy-text') }}
+                                        </small>
+                                    </div>
+                                </div>
+                                <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}</button>
+                            </form>
                         </div>
-                        <div class="row mb-3">
-                            <label for="members-input" class="col-sm-4 col-form-label">{{ $t('distlist.recipients') }}</label>
-                            <div class="col-sm-8">
-                                <list-input id="members" :list="list.members"></list-input>
-                            </div>
-                        </div>
-                        <button class="btn btn-primary" type="submit"><svg-icon icon="check"></svg-icon> {{ $t('btn.submit') }}</button>
-                    </form>
+                    </div>
                 </div>
             </div>
         </div>
     </div>
 </template>
 
 <script>
     import ListInput from '../Widgets/ListInput'
     import StatusComponent from '../Widgets/Status'
 
     export default {
         components: {
             ListInput,
             StatusComponent
         },
         data() {
             return {
                 list_id: null,
-                list: { members: [] },
+                list: { members: [], config: {} },
                 status: {}
             }
         },
         created() {
             this.list_id = this.$route.params.list
 
             if (this.list_id != 'new') {
                 this.$root.startLoading()
 
                 axios.get('/api/v4/groups/' + this.list_id)
                     .then(response => {
                         this.$root.stopLoading()
                         this.list = response.data
                         this.status = response.data.statusInfo
                     })
                     .catch(this.$root.errorHandler)
             }
         },
         methods: {
             deleteList() {
                 axios.delete('/api/v4/groups/' + this.list_id)
                     .then(response => {
                         if (response.data.status == 'success') {
                             this.$toast.success(response.data.message)
                             this.$router.push({ name: 'distlists' })
                         }
                     })
             },
             statusUpdate(list) {
                 this.list = Object.assign({}, this.list, list)
             },
             submit() {
                 this.$root.clearFormValidation($('#list-info form'))
 
                 let method = 'post'
                 let location = '/api/v4/groups'
 
                 if (this.list_id !== 'new') {
                     method = 'put'
                     location += '/' + this.list_id
                 }
 
                 axios[method](location, this.list)
                     .then(response => {
                         this.$toast.success(response.data.message)
                         this.$router.push({ name: 'distlists' })
                     })
+            },
+            submitSettings() {
+                this.$root.clearFormValidation($('#settings form'))
+                let post = this.list.config
+
+                axios.post('/api/v4/groups/' + this.list_id + '/config', post)
+                    .then(response => {
+                        this.$toast.success(response.data.message)
+                    })
             }
         }
     }
 </script>
diff --git a/src/routes/api.php b/src/routes/api.php
index b8ee50ff..248f879f 100644
--- a/src/routes/api.php
+++ b/src/routes/api.php
@@ -1,251 +1,250 @@
 <?php
 
 use Illuminate\Http\Request;
 
 /*
 |--------------------------------------------------------------------------
 | API Routes
 |--------------------------------------------------------------------------
 |
 | Here is where you can register API routes for your application. These
 | routes are loaded by the RouteServiceProvider within a group which
 | is assigned the "api" middleware group. Enjoy building your API!
 |
 */
 
 $prefix = \trim(\parse_url(\config('app.url'), PHP_URL_PATH), '/') . '/';
 
 Route::group(
     [
         'middleware' => 'api',
         'prefix' => $prefix . 'api/auth'
     ],
     function ($router) {
         Route::post('login', 'API\AuthController@login');
 
         Route::group(
             ['middleware' => 'auth:api'],
             function ($router) {
                 Route::get('info', 'API\AuthController@info');
                 Route::post('info', 'API\AuthController@info');
                 Route::post('logout', 'API\AuthController@logout');
                 Route::post('refresh', 'API\AuthController@refresh');
             }
         );
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'middleware' => 'api',
         'prefix' => $prefix . 'api/auth'
     ],
     function ($router) {
         Route::post('password-reset/init', 'API\PasswordResetController@init');
         Route::post('password-reset/verify', 'API\PasswordResetController@verify');
         Route::post('password-reset', 'API\PasswordResetController@reset');
 
         Route::post('signup/init', 'API\SignupController@init');
         Route::get('signup/invitations/{id}', 'API\SignupController@invitation');
         Route::get('signup/plans', 'API\SignupController@plans');
         Route::post('signup/verify', 'API\SignupController@verify');
         Route::post('signup', 'API\SignupController@signup');
     }
 );
 
-
-
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'middleware' => 'auth:api',
         'prefix' => $prefix . 'api/v4'
     ],
     function () {
         Route::post('companion/register', 'API\V4\CompanionAppsController@register');
 
         Route::post('auth-attempts/{id}/confirm', 'API\V4\AuthAttemptsController@confirm');
         Route::post('auth-attempts/{id}/deny', 'API\V4\AuthAttemptsController@deny');
         Route::get('auth-attempts/{id}/details', 'API\V4\AuthAttemptsController@details');
         Route::get('auth-attempts', 'API\V4\AuthAttemptsController@index');
 
         Route::apiResource('domains', API\V4\DomainsController::class);
         Route::get('domains/{id}/confirm', 'API\V4\DomainsController@confirm');
         Route::get('domains/{id}/skus', 'API\V4\SkusController@domainSkus');
         Route::get('domains/{id}/status', 'API\V4\DomainsController@status');
         Route::post('domains/{id}/config', 'API\V4\DomainsController@setConfig');
 
         Route::apiResource('groups', API\V4\GroupsController::class);
         Route::get('groups/{id}/status', 'API\V4\GroupsController@status');
+        Route::post('groups/{id}/config', 'API\V4\GroupsController@setConfig');
 
         Route::apiResource('packages', API\V4\PackagesController::class);
         Route::apiResource('skus', API\V4\SkusController::class);
 
         Route::apiResource('users', API\V4\UsersController::class);
         Route::post('users/{id}/config', 'API\V4\UsersController@setConfig');
         Route::get('users/{id}/skus', 'API\V4\SkusController@userSkus');
         Route::get('users/{id}/status', 'API\V4\UsersController@status');
 
         Route::apiResource('wallets', API\V4\WalletsController::class);
         Route::get('wallets/{id}/transactions', 'API\V4\WalletsController@transactions');
         Route::get('wallets/{id}/receipts', 'API\V4\WalletsController@receipts');
         Route::get('wallets/{id}/receipts/{receipt}', 'API\V4\WalletsController@receiptDownload');
 
         Route::post('payments', 'API\V4\PaymentsController@store');
         //Route::delete('payments', 'API\V4\PaymentsController@cancel');
         Route::get('payments/mandate', 'API\V4\PaymentsController@mandate');
         Route::post('payments/mandate', 'API\V4\PaymentsController@mandateCreate');
         Route::put('payments/mandate', 'API\V4\PaymentsController@mandateUpdate');
         Route::delete('payments/mandate', 'API\V4\PaymentsController@mandateDelete');
         Route::get('payments/methods', 'API\V4\PaymentsController@paymentMethods');
         Route::get('payments/pending', 'API\V4\PaymentsController@payments');
         Route::get('payments/has-pending', 'API\V4\PaymentsController@hasPayments');
 
         Route::get('openvidu/rooms', 'API\V4\OpenViduController@index');
         Route::post('openvidu/rooms/{id}/close', 'API\V4\OpenViduController@closeRoom');
         Route::post('openvidu/rooms/{id}/config', 'API\V4\OpenViduController@setRoomConfig');
 
         // FIXME: I'm not sure about this one, should we use DELETE request maybe?
         Route::post('openvidu/rooms/{id}/connections/{conn}/dismiss', 'API\V4\OpenViduController@dismissConnection');
         Route::put('openvidu/rooms/{id}/connections/{conn}', 'API\V4\OpenViduController@updateConnection');
         Route::post('openvidu/rooms/{id}/request/{reqid}/accept', 'API\V4\OpenViduController@acceptJoinRequest');
         Route::post('openvidu/rooms/{id}/request/{reqid}/deny', 'API\V4\OpenViduController@denyJoinRequest');
     }
 );
 
 // Note: In Laravel 7.x we could just use withoutMiddleware() instead of a separate group
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'prefix' => $prefix . 'api/v4'
     ],
     function () {
         Route::post('openvidu/rooms/{id}', 'API\V4\OpenViduController@joinRoom');
         Route::post('openvidu/rooms/{id}/connections', 'API\V4\OpenViduController@createConnection');
         // FIXME: I'm not sure about this one, should we use DELETE request maybe?
         Route::post('openvidu/rooms/{id}/connections/{conn}/dismiss', 'API\V4\OpenViduController@dismissConnection');
         Route::put('openvidu/rooms/{id}/connections/{conn}', 'API\V4\OpenViduController@updateConnection');
         Route::post('openvidu/rooms/{id}/request/{reqid}/accept', 'API\V4\OpenViduController@acceptJoinRequest');
         Route::post('openvidu/rooms/{id}/request/{reqid}/deny', 'API\V4\OpenViduController@denyJoinRequest');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'middleware' => 'api',
         'prefix' => $prefix . 'api/v4'
     ],
     function ($router) {
         Route::post('support/request', 'API\V4\SupportController@request');
     }
 );
 
 Route::group(
     [
         'domain' => \config('app.website_domain'),
         'prefix' => $prefix . 'api/webhooks'
     ],
     function () {
         Route::post('payment/{provider}', 'API\V4\PaymentsController@webhook');
         Route::post('meet/openvidu', 'API\V4\OpenViduController@webhook');
     }
 );
 
 if (\config('app.with_services')) {
     Route::group(
         [
             'domain' => 'services.' . \config('app.website_domain'),
             'prefix' => $prefix . 'api/webhooks'
         ],
         function () {
             Route::get('nginx', 'API\V4\NGINXController@authenticate');
             Route::post('policy/greylist', 'API\V4\PolicyController@greylist');
             Route::post('policy/ratelimit', 'API\V4\PolicyController@ratelimit');
             Route::post('policy/spf', 'API\V4\PolicyController@senderPolicyFramework');
         }
     );
 }
 
 if (\config('app.with_admin')) {
     Route::group(
         [
             'domain' => 'admin.' . \config('app.website_domain'),
             'middleware' => ['auth:api', 'admin'],
             'prefix' => $prefix . 'api/v4',
         ],
         function () {
             Route::apiResource('domains', API\V4\Admin\DomainsController::class);
             Route::get('domains/{id}/skus', 'API\V4\Admin\SkusController@domainSkus');
             Route::post('domains/{id}/suspend', 'API\V4\Admin\DomainsController@suspend');
             Route::post('domains/{id}/unsuspend', 'API\V4\Admin\DomainsController@unsuspend');
 
             Route::apiResource('groups', API\V4\Admin\GroupsController::class);
             Route::post('groups/{id}/suspend', 'API\V4\Admin\GroupsController@suspend');
             Route::post('groups/{id}/unsuspend', 'API\V4\Admin\GroupsController@unsuspend');
 
             Route::apiResource('skus', API\V4\Admin\SkusController::class);
             Route::apiResource('users', API\V4\Admin\UsersController::class);
             Route::get('users/{id}/discounts', 'API\V4\Reseller\DiscountsController@userDiscounts');
             Route::post('users/{id}/reset2FA', 'API\V4\Admin\UsersController@reset2FA');
             Route::get('users/{id}/skus', 'API\V4\Admin\SkusController@userSkus');
             Route::post('users/{id}/skus/{sku}', 'API\V4\Admin\UsersController@setSku');
             Route::post('users/{id}/suspend', 'API\V4\Admin\UsersController@suspend');
             Route::post('users/{id}/unsuspend', 'API\V4\Admin\UsersController@unsuspend');
             Route::apiResource('wallets', API\V4\Admin\WalletsController::class);
             Route::post('wallets/{id}/one-off', 'API\V4\Admin\WalletsController@oneOff');
             Route::get('wallets/{id}/transactions', 'API\V4\Admin\WalletsController@transactions');
 
             Route::get('stats/chart/{chart}', 'API\V4\Admin\StatsController@chart');
         }
     );
 }
 
 if (\config('app.with_reseller')) {
     Route::group(
         [
             'domain' => 'reseller.' . \config('app.website_domain'),
             'middleware' => ['auth:api', 'reseller'],
             'prefix' => $prefix . 'api/v4',
         ],
         function () {
             Route::apiResource('domains', API\V4\Reseller\DomainsController::class);
             Route::get('domains/{id}/skus', 'API\V4\Reseller\SkusController@domainSkus');
             Route::post('domains/{id}/suspend', 'API\V4\Reseller\DomainsController@suspend');
             Route::post('domains/{id}/unsuspend', 'API\V4\Reseller\DomainsController@unsuspend');
 
             Route::apiResource('groups', API\V4\Reseller\GroupsController::class);
             Route::post('groups/{id}/suspend', 'API\V4\Reseller\GroupsController@suspend');
             Route::post('groups/{id}/unsuspend', 'API\V4\Reseller\GroupsController@unsuspend');
 
             Route::apiResource('invitations', API\V4\Reseller\InvitationsController::class);
             Route::post('invitations/{id}/resend', 'API\V4\Reseller\InvitationsController@resend');
 
             Route::post('payments', 'API\V4\Reseller\PaymentsController@store');
             Route::get('payments/mandate', 'API\V4\Reseller\PaymentsController@mandate');
             Route::post('payments/mandate', 'API\V4\Reseller\PaymentsController@mandateCreate');
             Route::put('payments/mandate', 'API\V4\Reseller\PaymentsController@mandateUpdate');
             Route::delete('payments/mandate', 'API\V4\Reseller\PaymentsController@mandateDelete');
             Route::get('payments/methods', 'API\V4\Reseller\PaymentsController@paymentMethods');
             Route::get('payments/pending', 'API\V4\Reseller\PaymentsController@payments');
             Route::get('payments/has-pending', 'API\V4\Reseller\PaymentsController@hasPayments');
 
             Route::apiResource('skus', API\V4\Reseller\SkusController::class);
             Route::apiResource('users', API\V4\Reseller\UsersController::class);
             Route::get('users/{id}/discounts', 'API\V4\Reseller\DiscountsController@userDiscounts');
             Route::post('users/{id}/reset2FA', 'API\V4\Reseller\UsersController@reset2FA');
             Route::get('users/{id}/skus', 'API\V4\Reseller\SkusController@userSkus');
             Route::post('users/{id}/skus/{sku}', 'API\V4\Admin\UsersController@setSku');
             Route::post('users/{id}/suspend', 'API\V4\Reseller\UsersController@suspend');
             Route::post('users/{id}/unsuspend', 'API\V4\Reseller\UsersController@unsuspend');
             Route::apiResource('wallets', API\V4\Reseller\WalletsController::class);
             Route::post('wallets/{id}/one-off', 'API\V4\Reseller\WalletsController@oneOff');
             Route::get('wallets/{id}/receipts', 'API\V4\Reseller\WalletsController@receipts');
             Route::get('wallets/{id}/receipts/{receipt}', 'API\V4\Reseller\WalletsController@receiptDownload');
             Route::get('wallets/{id}/transactions', 'API\V4\Reseller\WalletsController@transactions');
 
             Route::get('stats/chart/{chart}', 'API\V4\Reseller\StatsController@chart');
         }
     );
 }
diff --git a/src/tests/Browser/Admin/DistlistTest.php b/src/tests/Browser/Admin/DistlistTest.php
index 69b31e72..0a5c7f4a 100644
--- a/src/tests/Browser/Admin/DistlistTest.php
+++ b/src/tests/Browser/Admin/DistlistTest.php
@@ -1,128 +1,136 @@
 <?php
 
 namespace Tests\Browser\Admin;
 
 use App\Group;
 use Illuminate\Support\Facades\Queue;
 use Tests\Browser;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Admin\Distlist as DistlistPage;
 use Tests\Browser\Pages\Admin\User as UserPage;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\TestCaseDusk;
 
 class DistlistTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
         self::useAdminUrl();
 
         $this->deleteTestGroup('group-test@kolab.org');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestGroup('group-test@kolab.org');
 
         parent::tearDown();
     }
 
     /**
      * Test distlist info page (unauthenticated)
      */
     public function testDistlistUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $user = $this->getTestUser('john@kolab.org');
             $group = $this->getTestGroup('group-test@kolab.org');
             $group->assignToWallet($user->wallets->first());
 
             $browser->visit('/distlist/' . $group->id)->on(new Home());
         });
     }
 
     /**
      * Test distribution list info page
      */
     public function testInfo(): void
     {
         Queue::fake();
 
         $this->browse(function (Browser $browser) {
             $user = $this->getTestUser('john@kolab.org');
             $group = $this->getTestGroup('group-test@kolab.org');
             $group->assignToWallet($user->wallets->first());
             $group->members = ['test1@gmail.com', 'test2@gmail.com'];
             $group->save();
+            $group->setConfig(['sender_policy' => ['test1.com', 'test2.com']]);
 
             $distlist_page = new DistlistPage($group->id);
             $user_page = new UserPage($user->id);
 
             // Goto the distlist page
             $browser->visit(new Home())
                 ->submitLogon('jeroen@jeroen.jeroen', \App\Utils::generatePassphrase(), true)
                 ->on(new Dashboard())
                 ->visit($user_page)
                 ->on($user_page)
                 ->click('@nav #tab-distlists')
                 ->pause(1000)
                 ->click('@user-distlists table tbody tr:first-child td a')
                 ->on($distlist_page)
                 ->assertSeeIn('@distlist-info .card-title', $group->email)
                 ->with('@distlist-info form', function (Browser $browser) use ($group) {
                     $browser->assertElementsCount('.row', 3)
                         ->assertSeeIn('.row:nth-child(1) label', 'ID (Created)')
                         ->assertSeeIn('.row:nth-child(1) #distlistid', "{$group->id} ({$group->created_at})")
                         ->assertSeeIn('.row:nth-child(2) label', 'Status')
                         ->assertSeeIn('.row:nth-child(2) #status.text-danger', 'Not Ready')
                         ->assertSeeIn('.row:nth-child(3) label', 'Recipients')
                         ->assertSeeIn('.row:nth-child(3) #members', $group->members[0])
                         ->assertSeeIn('.row:nth-child(3) #members', $group->members[1]);
+                })
+                ->assertElementsCount('ul.nav-tabs', 1)
+                ->assertSeeIn('ul.nav-tabs .nav-link', 'Settings')
+                ->with('@distlist-settings form', function (Browser $browser) {
+                    $browser->assertElementsCount('.row', 1)
+                        ->assertSeeIn('.row:nth-child(1) label', 'Sender Access List')
+                        ->assertSeeIn('.row:nth-child(1) #sender_policy', 'test1.com, test2.com');
                 });
 
             // Test invalid group identifier
             $browser->visit('/distlist/abc')->assertErrorPage(404);
         });
     }
 
     /**
      * Test suspending/unsuspending a distribution list
      *
      * @depends testInfo
      */
     public function testSuspendAndUnsuspend(): void
     {
         Queue::fake();
 
         $this->browse(function (Browser $browser) {
             $user = $this->getTestUser('john@kolab.org');
             $group = $this->getTestGroup('group-test@kolab.org');
             $group->assignToWallet($user->wallets->first());
             $group->status = Group::STATUS_ACTIVE | Group::STATUS_LDAP_READY;
             $group->save();
 
             $browser->visit(new DistlistPage($group->id))
                 ->assertVisible('@distlist-info #button-suspend')
                 ->assertMissing('@distlist-info #button-unsuspend')
                 ->assertSeeIn('@distlist-info #status.text-success', 'Active')
                 ->click('@distlist-info #button-suspend')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list suspended successfully.')
                 ->assertSeeIn('@distlist-info #status.text-warning', 'Suspended')
                 ->assertMissing('@distlist-info #button-suspend')
                 ->click('@distlist-info #button-unsuspend')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list unsuspended successfully.')
                 ->assertSeeIn('@distlist-info #status.text-success', 'Active')
                 ->assertVisible('@distlist-info #button-suspend')
                 ->assertMissing('@distlist-info #button-unsuspend');
         });
     }
 }
diff --git a/src/tests/Browser/Components/ListInput.php b/src/tests/Browser/Components/ListInput.php
index 90ba6109..765b98e6 100644
--- a/src/tests/Browser/Components/ListInput.php
+++ b/src/tests/Browser/Components/ListInput.php
@@ -1,104 +1,104 @@
 <?php
 
 namespace Tests\Browser\Components;
 
 use Laravel\Dusk\Component as BaseComponent;
 use PHPUnit\Framework\Assert as PHPUnit;
 
 class ListInput extends BaseComponent
 {
     protected $selector;
 
 
     public function __construct($selector)
     {
         $this->selector = $selector;
     }
 
     /**
      * Get the root selector for the component.
      *
      * @return string
      */
     public function selector()
     {
         return $this->selector;
     }
 
     /**
      * Assert that the browser page contains the component.
      *
      * @param \Laravel\Dusk\Browser $browser
      *
      * @return void
      */
     public function assert($browser)
     {
-        $browser->assertVisible($this->selector())
-            ->assertVisible('@input')
-            ->assertVisible('@add-btn');
+        $browser->assertVisible($this->selector)
+            ->assertVisible("{$this->selector} @input")
+            ->assertVisible("{$this->selector} @add-btn");
     }
 
     /**
      * Get the element shortcuts for the component.
      *
      * @return array
      */
     public function elements()
     {
         return [
             '@input' => '.input-group:first-child input',
             '@add-btn' => '.input-group:first-child a.btn',
         ];
     }
 
     /**
      * Assert list input content
      */
     public function assertListInputValue($browser, array $list)
     {
         if (empty($list)) {
             $browser->assertMissing('.input-group:not(:first-child)');
             return;
         }
 
         foreach ($list as $idx => $value) {
             $selector = '.input-group:nth-child(' . ($idx + 2) . ') input';
             $browser->assertVisible($selector)->assertValue($selector, $value);
         }
     }
 
     /**
      * Add list entry
      */
     public function addListEntry($browser, string $value)
     {
         $browser->type('@input', $value)
             ->click('@add-btn')
             ->assertValue('.input-group:last-child input', $value);
     }
 
     /**
      * Remove list entry
      */
     public function removeListEntry($browser, int $num)
     {
         $selector = '.input-group:nth-child(' . ($num + 1) . ') a.btn';
         $browser->click($selector);
     }
 
     /**
      * Assert an error message on the widget
      */
     public function assertFormError($browser, int $num, string $msg, bool $focused = false)
     {
         $selector = '.input-group:nth-child(' . ($num + 1) . ') input.is-invalid';
 
         $browser->assertVisible($selector)
             ->assertSeeIn(' + .invalid-feedback', $msg);
 
         if ($focused) {
             $browser->assertFocused($selector);
         }
     }
 }
diff --git a/src/tests/Browser/DistlistTest.php b/src/tests/Browser/DistlistTest.php
index cf0c39a3..14207cdb 100644
--- a/src/tests/Browser/DistlistTest.php
+++ b/src/tests/Browser/DistlistTest.php
@@ -1,266 +1,315 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Group;
 use App\Sku;
 use Tests\Browser;
 use Tests\Browser\Components\ListInput;
 use Tests\Browser\Components\Status;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\DistlistInfo;
 use Tests\Browser\Pages\DistlistList;
 use Tests\TestCaseDusk;
 
 class DistlistTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestGroup('group-test@kolab.org');
         $this->clearBetaEntitlements();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestGroup('group-test@kolab.org');
         $this->clearBetaEntitlements();
 
         parent::tearDown();
     }
 
     /**
      * Test distlist info page (unauthenticated)
      */
     public function testInfoUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/distlist/abc')->on(new Home());
         });
     }
 
     /**
      * Test distlist list page (unauthenticated)
      */
     public function testListUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/distlists')->on(new Home());
         });
     }
 
     /**
      * Test distlist list page
      */
     public function testList(): void
     {
         // Log on the user
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->assertMissing('@links .link-distlists');
         });
 
         // Test that Distribution lists page is not accessible without the 'distlist' entitlement
         $this->browse(function (Browser $browser) {
             $browser->visit('/distlists')
                 ->assertErrorPage(403);
         });
 
         // Create a single group, add beta+distlist entitlements
         $john = $this->getTestUser('john@kolab.org');
         $this->addDistlistEntitlement($john);
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
 
         // Test distribution lists page
         $this->browse(function (Browser $browser) {
             $browser->visit(new Dashboard())
                 ->assertSeeIn('@links .link-distlists', 'Distribution lists')
                 ->click('@links .link-distlists')
                 ->on(new DistlistList())
                 ->whenAvailable('@table', function (Browser $browser) {
                     $browser->waitFor('tbody tr')
                         ->assertElementsCount('tbody tr', 1)
                         ->assertSeeIn('tbody tr:nth-child(1) a', 'group-test@kolab.org')
                         ->assertText('tbody tr:nth-child(1) svg.text-danger title', 'Not Ready')
                         ->assertMissing('tfoot');
                 });
         });
     }
 
     /**
      * Test distlist creation/editing/deleting
      *
      * @depends testList
      */
     public function testCreateUpdateDelete(): void
     {
         // Test that the page is not available accessible without the 'distlist' entitlement
         $this->browse(function (Browser $browser) {
             $browser->visit('/distlist/new')
                 ->assertErrorPage(403);
         });
 
         // Add beta+distlist entitlements
         $john = $this->getTestUser('john@kolab.org');
         $this->addDistlistEntitlement($john);
 
         $this->browse(function (Browser $browser) {
             // Create a group
             $browser->visit(new DistlistList())
                 ->assertSeeIn('button.create-list', 'Create list')
                 ->click('button.create-list')
                 ->on(new DistlistInfo())
                 ->assertSeeIn('#distlist-info .card-title', 'New distribution list')
-                ->with('@form', function (Browser $browser) {
+                ->assertSeeIn('@nav #tab-general', 'General')
+                ->assertMissing('@nav #tab-settings')
+                ->with('@general', function (Browser $browser) {
                     // Assert form content
                     $browser->assertMissing('#status')
                         ->assertSeeIn('div.row:nth-child(1) label', 'Email')
                         ->assertValue('div.row:nth-child(1) input[type=text]', '')
                         ->assertSeeIn('div.row:nth-child(2) label', 'Recipients')
                         ->assertVisible('div.row:nth-child(2) .list-input')
                         ->with(new ListInput('#members'), function (Browser $browser) {
                             $browser->assertListInputValue([])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('button[type=submit]', 'Submit');
                 })
                 // Test error conditions
                 ->type('#email', 'group-test@kolabnow.com')
-                ->click('button[type=submit]')
+                ->click('@general button[type=submit]')
                 ->waitFor('#email + .invalid-feedback')
                 ->assertSeeIn('#email + .invalid-feedback', 'The specified domain is not available.')
                 ->assertFocused('#email')
                 ->waitFor('#members + .invalid-feedback')
                 ->assertSeeIn('#members + .invalid-feedback', 'At least one recipient is required.')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                 // Test successful group creation
                 ->type('#email', 'group-test@kolab.org')
                 ->with(new ListInput('#members'), function (Browser $browser) {
                     $browser->addListEntry('test1@gmail.com')
                         ->addListEntry('test2@gmail.com');
                 })
-                ->click('button[type=submit]')
+                ->click('@general button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list created successfully.')
                 ->on(new DistlistList())
                 ->assertElementsCount('@table tbody tr', 1);
 
             // Test group update
             $browser->click('@table tr:nth-child(1) a')
                 ->on(new DistlistInfo())
                 ->assertSeeIn('#distlist-info .card-title', 'Distribution list')
-                ->with('@form', function (Browser $browser) {
+                ->with('@general', function (Browser $browser) {
                     // Assert form content
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Status')
                         ->assertSeeIn('div.row:nth-child(1) span.text-danger', 'Not Ready')
                         ->assertSeeIn('div.row:nth-child(2) label', 'Email')
                         ->assertValue('div.row:nth-child(2) input[type=text]:disabled', 'group-test@kolab.org')
                         ->assertSeeIn('div.row:nth-child(3) label', 'Recipients')
                         ->assertVisible('div.row:nth-child(3) .list-input')
                         ->with(new ListInput('#members'), function (Browser $browser) {
                             $browser->assertListInputValue(['test1@gmail.com', 'test2@gmail.com'])
                                 ->assertValue('@input', '');
                         })
                         ->assertSeeIn('button[type=submit]', 'Submit');
                 })
                 // Test error handling
                 ->with(new ListInput('#members'), function (Browser $browser) {
                     $browser->addListEntry('invalid address');
                 })
-                ->click('button[type=submit]')
+                ->click('@general button[type=submit]')
                 ->waitFor('#members + .invalid-feedback')
                 ->assertSeeIn('#members + .invalid-feedback', 'The specified email address is invalid.')
                 ->assertVisible('#members .input-group:nth-child(4) input.is-invalid')
                 ->assertToast(Toast::TYPE_ERROR, 'Form validation error')
                 // Test successful update
                 ->with(new ListInput('#members'), function (Browser $browser) {
                     $browser->removeListEntry(3)->removeListEntry(2);
                 })
-                ->click('button[type=submit]')
+                ->click('@general button[type=submit]')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list updated successfully.')
                 ->assertMissing('.invalid-feedback')
                 ->on(new DistlistList())
                 ->assertElementsCount('@table tbody tr', 1);
 
             $group = Group::where('email', 'group-test@kolab.org')->first();
             $this->assertSame(['test1@gmail.com'], $group->members);
 
             // Test group deletion
             $browser->click('@table tr:nth-child(1) a')
                 ->on(new DistlistInfo())
                 ->assertSeeIn('button.button-delete', 'Delete list')
                 ->click('button.button-delete')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list deleted successfully.')
                 ->on(new DistlistList())
                 ->assertElementsCount('@table tbody tr', 0)
                 ->assertVisible('@table tfoot');
 
             $this->assertNull(Group::where('email', 'group-test@kolab.org')->first());
         });
     }
 
     /**
      * Test distribution list status
      *
      * @depends testList
      */
     public function testStatus(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $this->addDistlistEntitlement($john);
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
         $group->status = Group::STATUS_NEW | Group::STATUS_ACTIVE;
         $group->save();
 
         $this->assertFalse($group->isLdapReady());
 
         $this->browse(function ($browser) use ($group) {
             // Test auto-refresh
             $browser->visit('/distlist/' . $group->id)
                 ->on(new DistlistInfo())
                 ->with(new Status(), function ($browser) {
                     $browser->assertSeeIn('@body', 'We are preparing the distribution list')
                         ->assertProgress(83, 'Creating a distribution list...', 'pending')
                         ->assertMissing('@refresh-button')
                         ->assertMissing('@refresh-text')
                         ->assertMissing('#status-link')
                         ->assertMissing('#status-verify');
                 });
 
             $group->status |= Group::STATUS_LDAP_READY;
             $group->save();
 
             // Test Verify button
             $browser->waitUntilMissing('@status', 10);
         });
 
         // TODO: Test all group statuses on the list
     }
 
+    /**
+     * Test distribution list settings
+     */
+    public function testSettings(): void
+    {
+        $john = $this->getTestUser('john@kolab.org');
+        $this->addDistlistEntitlement($john);
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+        $group->status = Group::STATUS_NEW | Group::STATUS_ACTIVE;
+        $group->save();
+
+        $this->browse(function ($browser) use ($group) {
+            // Test auto-refresh
+            $browser->visit('/distlist/' . $group->id)
+                ->on(new DistlistInfo())
+                ->assertSeeIn('@nav #tab-general', 'General')
+                ->assertSeeIn('@nav #tab-settings', 'Settings')
+                ->click('@nav #tab-settings')
+                ->with('@settings form', function (Browser $browser) {
+                    // Assert form content
+                    $browser->assertSeeIn('div.row:nth-child(1) label', 'Sender Access List')
+                        ->assertVisible('div.row:nth-child(1) .list-input')
+                        ->with(new ListInput('#sender-policy'), function (Browser $browser) {
+                            $browser->assertListInputValue([])
+                                ->assertValue('@input', '');
+                        })
+                        ->assertSeeIn('button[type=submit]', 'Submit');
+                })
+                // Test error handling
+                ->with(new ListInput('#sender-policy'), function (Browser $browser) {
+                    $browser->addListEntry('test.com');
+                })
+                ->click('@settings button[type=submit]')
+                ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list settings updated successfully.')
+                ->assertMissing('.invalid-feedback')
+                ->refresh()
+                ->on(new DistlistInfo())
+                ->click('@nav #tab-settings')
+                ->with('@settings form', function (Browser $browser) {
+                    $browser->with(new ListInput('#sender-policy'), function (Browser $browser) {
+                        $browser->assertListInputValue(['test.com'])
+                            ->assertValue('@input', '');
+                    });
+                });
+        });
+    }
 
     /**
      * Register the beta + distlist entitlements for the user
      */
     private function addDistlistEntitlement($user): void
     {
         // Add beta+distlist entitlements
         $beta_sku = Sku::where('title', 'beta')->first();
         $distlist_sku = Sku::where('title', 'distlist')->first();
         $user->assignSku($beta_sku);
         $user->assignSku($distlist_sku);
     }
 }
diff --git a/src/tests/Browser/Pages/Admin/Distlist.php b/src/tests/Browser/Pages/Admin/Distlist.php
index 1742c455..e1edd794 100644
--- a/src/tests/Browser/Pages/Admin/Distlist.php
+++ b/src/tests/Browser/Pages/Admin/Distlist.php
@@ -1,57 +1,57 @@
 <?php
 
 namespace Tests\Browser\Pages\Admin;
 
 use Laravel\Dusk\Page;
 
 class Distlist extends Page
 {
     protected $listid;
 
     /**
      * Object constructor.
      *
      * @param int $listid Distribution list Id
      */
     public function __construct($listid)
     {
         $this->listid = $listid;
     }
 
     /**
      * Get the URL for the page.
      *
      * @return string
      */
     public function url(): string
     {
         return '/distlist/' . $this->listid;
     }
 
     /**
      * Assert that the browser is on the page.
      *
      * @param \Laravel\Dusk\Browser $browser The browser object
      *
      * @return void
      */
     public function assert($browser): void
     {
         $browser->waitForLocation($this->url())
             ->waitFor('@distlist-info');
     }
 
     /**
      * Get the element shortcuts for the page.
      *
      * @return array
      */
     public function elements(): array
     {
         return [
             '@app' => '#app',
             '@distlist-info' => '#distlist-info',
-            '@distlist-config' => '#distlist-config',
+            '@distlist-settings' => '#distlist-settings',
         ];
     }
 }
diff --git a/src/tests/Browser/Pages/DistlistInfo.php b/src/tests/Browser/Pages/DistlistInfo.php
index 0e38643b..86d272da 100644
--- a/src/tests/Browser/Pages/DistlistInfo.php
+++ b/src/tests/Browser/Pages/DistlistInfo.php
@@ -1,45 +1,47 @@
 <?php
 
 namespace Tests\Browser\Pages;
 
 use Laravel\Dusk\Page;
 
 class DistlistInfo extends Page
 {
     /**
      * Get the URL for the page.
      *
      * @return string
      */
     public function url(): string
     {
         return '';
     }
 
     /**
      * Assert that the browser is on the page.
      *
      * @param \Laravel\Dusk\Browser $browser The browser object
      *
      * @return void
      */
     public function assert($browser)
     {
-        $browser->waitFor('@form')
+        $browser->waitFor('@general')
             ->waitUntilMissing('.app-loader');
     }
 
     /**
      * Get the element shortcuts for the page.
      *
      * @return array
      */
     public function elements(): array
     {
         return [
             '@app' => '#app',
-            '@form' => '#distlist-info form',
+            '@general' => '#general',
+            '@nav' => 'ul.nav-tabs',
+            '@settings' => '#settings',
             '@status' => '#status-box',
         ];
     }
 }
diff --git a/src/tests/Browser/Reseller/DistlistTest.php b/src/tests/Browser/Reseller/DistlistTest.php
index eda38300..6adf7f9c 100644
--- a/src/tests/Browser/Reseller/DistlistTest.php
+++ b/src/tests/Browser/Reseller/DistlistTest.php
@@ -1,128 +1,136 @@
 <?php
 
 namespace Tests\Browser\Reseller;
 
 use App\Group;
 use Illuminate\Support\Facades\Queue;
 use Tests\Browser;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Admin\Distlist as DistlistPage;
 use Tests\Browser\Pages\Admin\User as UserPage;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\TestCaseDusk;
 
 class DistlistTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
         self::useResellerUrl();
 
         $this->deleteTestGroup('group-test@kolab.org');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestGroup('group-test@kolab.org');
 
         parent::tearDown();
     }
 
     /**
      * Test distlist info page (unauthenticated)
      */
     public function testDistlistUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $user = $this->getTestUser('john@kolab.org');
             $group = $this->getTestGroup('group-test@kolab.org');
             $group->assignToWallet($user->wallets->first());
 
             $browser->visit('/distlist/' . $group->id)->on(new Home());
         });
     }
 
     /**
      * Test distribution list info page
      */
     public function testInfo(): void
     {
         Queue::fake();
 
         $this->browse(function (Browser $browser) {
             $user = $this->getTestUser('john@kolab.org');
             $group = $this->getTestGroup('group-test@kolab.org');
             $group->assignToWallet($user->wallets->first());
             $group->members = ['test1@gmail.com', 'test2@gmail.com'];
             $group->save();
+            $group->setConfig(['sender_policy' => ['test1.com', 'test2.com']]);
 
             $distlist_page = new DistlistPage($group->id);
             $user_page = new UserPage($user->id);
 
             // Goto the distlist page
             $browser->visit(new Home())
                 ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
                 ->on(new Dashboard())
                 ->visit($user_page)
                 ->on($user_page)
                 ->click('@nav #tab-distlists')
                 ->pause(1000)
                 ->click('@user-distlists table tbody tr:first-child td a')
                 ->on($distlist_page)
                 ->assertSeeIn('@distlist-info .card-title', $group->email)
                 ->with('@distlist-info form', function (Browser $browser) use ($group) {
                     $browser->assertElementsCount('.row', 3)
                         ->assertSeeIn('.row:nth-child(1) label', 'ID (Created)')
                         ->assertSeeIn('.row:nth-child(1) #distlistid', "{$group->id} ({$group->created_at})")
                         ->assertSeeIn('.row:nth-child(2) label', 'Status')
                         ->assertSeeIn('.row:nth-child(2) #status.text-danger', 'Not Ready')
                         ->assertSeeIn('.row:nth-child(3) label', 'Recipients')
                         ->assertSeeIn('.row:nth-child(3) #members', $group->members[0])
                         ->assertSeeIn('.row:nth-child(3) #members', $group->members[1]);
+                })
+                ->assertElementsCount('ul.nav-tabs', 1)
+                ->assertSeeIn('ul.nav-tabs .nav-link', 'Settings')
+                ->with('@distlist-settings form', function (Browser $browser) {
+                    $browser->assertElementsCount('.row', 1)
+                        ->assertSeeIn('.row:nth-child(1) label', 'Sender Access List')
+                        ->assertSeeIn('.row:nth-child(1) #sender_policy', 'test1.com, test2.com');
                 });
 
             // Test invalid group identifier
             $browser->visit('/distlist/abc')->assertErrorPage(404);
         });
     }
 
     /**
      * Test suspending/unsuspending a distribution list
      *
      * @depends testInfo
      */
     public function testSuspendAndUnsuspend(): void
     {
         Queue::fake();
 
         $this->browse(function (Browser $browser) {
             $user = $this->getTestUser('john@kolab.org');
             $group = $this->getTestGroup('group-test@kolab.org');
             $group->assignToWallet($user->wallets->first());
             $group->status = Group::STATUS_ACTIVE | Group::STATUS_LDAP_READY;
             $group->save();
 
             $browser->visit(new DistlistPage($group->id))
                 ->assertVisible('@distlist-info #button-suspend')
                 ->assertMissing('@distlist-info #button-unsuspend')
                 ->assertSeeIn('@distlist-info #status.text-success', 'Active')
                 ->click('@distlist-info #button-suspend')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list suspended successfully.')
                 ->assertSeeIn('@distlist-info #status.text-warning', 'Suspended')
                 ->assertMissing('@distlist-info #button-suspend')
                 ->click('@distlist-info #button-unsuspend')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Distribution list unsuspended successfully.')
                 ->assertSeeIn('@distlist-info #status.text-success', 'Active')
                 ->assertVisible('@distlist-info #button-suspend')
                 ->assertMissing('@distlist-info #button-unsuspend');
         });
     }
 }
diff --git a/src/tests/Browser/Reseller/WalletTest.php b/src/tests/Browser/Reseller/WalletTest.php
index 5f67f3c8..2df1d124 100644
--- a/src/tests/Browser/Reseller/WalletTest.php
+++ b/src/tests/Browser/Reseller/WalletTest.php
@@ -1,248 +1,248 @@
 <?php
 
 namespace Tests\Browser\Reseller;
 
 use App\Payment;
 use App\Providers\PaymentProvider;
 use App\Transaction;
 use App\Wallet;
 use Carbon\Carbon;
 use Tests\Browser;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\Wallet as WalletPage;
 use Tests\TestCaseDusk;
 
 class WalletTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
         self::useResellerUrl();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
         $wallet = $reseller->wallets()->first();
         $wallet->balance = 0;
         $wallet->save();
         $wallet->payments()->delete();
         $wallet->transactions()->delete();
 
         parent::tearDown();
     }
 
     /**
      * Test wallet page (unauthenticated)
      */
     public function testWalletUnauth(): void
     {
         // Test that the page requires authentication
         $this->browse(function (Browser $browser) {
             $browser->visit('/wallet')->on(new Home());
         });
     }
 
     /**
      * Test wallet "box" on Dashboard
      */
     public function testDashboard(): void
     {
         $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
         Wallet::where('user_id', $reseller->id)->update(['balance' => 125]);
 
         // Positive balance
         $this->browse(function (Browser $browser) {
             $browser->visit(new Home())
                 ->submitLogon('reseller@' . \config('app.domain'), \App\Utils::generatePassphrase(), true)
                 ->on(new Dashboard())
                 ->assertSeeIn('@links .link-wallet .name', 'Wallet')
                 ->assertSeeIn('@links .link-wallet .badge.bg-success', '1,25 CHF');
         });
 
         Wallet::where('user_id', $reseller->id)->update(['balance' => -1234]);
 
         // Negative balance
         $this->browse(function (Browser $browser) {
             $browser->visit(new Dashboard())
                 ->assertSeeIn('@links .link-wallet .name', 'Wallet')
                 ->assertSeeIn('@links .link-wallet .badge.bg-danger', '-12,34 CHF');
         });
     }
 
     /**
      * Test wallet page
      *
      * @depends testDashboard
      */
     public function testWallet(): void
     {
         $reseller = $this->getTestUser('reseller@' . \config('app.domain'));
         Wallet::where('user_id', $reseller->id)->update(['balance' => -1234]);
 
         $this->browse(function (Browser $browser) {
             $browser->click('@links .link-wallet')
                 ->on(new WalletPage())
                 ->assertSeeIn('#wallet .card-title', 'Account balance -12,34 CHF')
                 ->assertSeeIn('#wallet .card-title .text-danger', '-12,34 CHF')
                 ->assertSeeIn('#wallet .card-text', 'You are out of credit');
         });
     }
 
     /**
      * Test Receipts tab
      *
      * @depends testWallet
      */
     public function testReceipts(): void
     {
         $user = $this->getTestUser('reseller@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->payments()->delete();
 
         // Assert Receipts tab content when there's no receipts available
         $this->browse(function (Browser $browser) {
             $browser->visit(new WalletPage())
                 ->assertSeeIn('#wallet .card-title', 'Account balance 0,00 CHF')
                 ->assertSeeIn('#wallet .card-title .text-success', '0,00 CHF')
                 ->assertSeeIn('#wallet .card-text', 'You are in your free trial period.') // TODO
                 ->assertSeeIn('@nav #tab-receipts', 'Receipts')
                 ->with('@receipts-tab', function (Browser $browser) {
                     $browser->waitUntilMissing('.app-loader')
                         ->assertSeeIn('p', 'There are no receipts for payments')
                         ->assertDontSeeIn('p', 'Here you can download')
                         ->assertMissing('select')
                         ->assertMissing('button');
                 });
         });
 
         // Create some sample payments
         $receipts = [];
         $date = Carbon::create(intval(date('Y')) - 1, 3, 30);
         $payment = Payment::create([
                 'id' => 'AAA1',
                 'status' => PaymentProvider::STATUS_PAID,
                 'type' => PaymentProvider::TYPE_ONEOFF,
                 'description' => 'Paid in March',
                 'wallet_id' => $wallet->id,
                 'provider' => 'stripe',
                 'amount' => 1111,
                 'currency_amount' => 1111,
                 'currency' => 'CHF',
         ]);
         $payment->updated_at = $date;
         $payment->save();
         $receipts[] = $date->format('Y-m');
 
         $date = Carbon::create(intval(date('Y')) - 1, 4, 30);
         $payment = Payment::create([
                 'id' => 'AAA2',
                 'status' => PaymentProvider::STATUS_PAID,
                 'type' => PaymentProvider::TYPE_ONEOFF,
                 'description' => 'Paid in April',
                 'wallet_id' => $wallet->id,
                 'provider' => 'stripe',
                 'amount' => 1111,
                 'currency_amount' => 1111,
                 'currency' => 'CHF',
         ]);
         $payment->updated_at = $date;
         $payment->save();
         $receipts[] = $date->format('Y-m');
 
         // Assert Receipts tab with receipts available
         $this->browse(function (Browser $browser) use ($receipts) {
             $browser->refresh()
                 ->on(new WalletPage())
                 ->assertSeeIn('@nav #tab-receipts', 'Receipts')
                 ->with('@receipts-tab', function (Browser $browser) use ($receipts) {
                     $browser->waitUntilMissing('.app-loader')
                         ->assertDontSeeIn('p', 'There are no receipts for payments')
                         ->assertSeeIn('p', 'Here you can download')
                         ->assertSeeIn('button', 'Download')
                         ->assertElementsCount('select > option', 2)
                         ->assertSeeIn('select > option:nth-child(1)', $receipts[1])
                         ->assertSeeIn('select > option:nth-child(2)', $receipts[0]);
 
                     // Download a receipt file
                     $browser->select('select', $receipts[0])
                         ->click('button')
                         ->pause(2000);
 
                     $files = glob(__DIR__ . '/../downloads/*.pdf');
 
                     $filename = pathinfo($files[0], PATHINFO_BASENAME);
                     $this->assertTrue(strpos($filename, $receipts[0]) !== false);
 
                     $content = $browser->readDownloadedFile($filename, 0);
                     $this->assertStringStartsWith("%PDF-1.", $content);
 
                     $browser->removeDownloadedFile($filename);
                 });
         });
     }
 
     /**
      * Test History tab
      *
      * @depends testWallet
      */
     public function testHistory(): void
     {
         $user = $this->getTestUser('reseller@' . \config('app.domain'));
         $wallet = $user->wallets()->first();
         $wallet->transactions()->delete();
 
         // Create some sample transactions
         $transactions = $this->createTestTransactions($wallet);
         $transactions = array_reverse($transactions);
         $pages = array_chunk($transactions, 10 /* page size*/);
 
         $this->browse(function (Browser $browser) use ($pages) {
             $browser->on(new WalletPage())
                 ->assertSeeIn('@nav #tab-history', 'History')
                 ->click('@nav #tab-history')
                 ->with('@history-tab', function (Browser $browser) use ($pages) {
                     $browser->waitUntilMissing('.app-loader')
                         ->assertElementsCount('table tbody tr', 10)
                         ->assertMissing('table td.email')
-                        ->assertSeeIn('#transactions-loader button', 'Load more');
+                        ->assertSeeIn('.more-loader button', 'Load more');
 
                     foreach ($pages[0] as $idx => $transaction) {
                         $selector = 'table tbody tr:nth-child(' . ($idx + 1) . ')';
                         $priceStyle = $transaction->type == Transaction::WALLET_AWARD ? 'text-success' : 'text-danger';
                         $browser->assertSeeIn("$selector td.description", $transaction->shortDescription())
                             ->assertMissing("$selector td.selection button")
                             ->assertVisible("$selector td.price.{$priceStyle}");
                         // TODO: Test more transaction details
                     }
 
                     // Load the next page
-                    $browser->click('#transactions-loader button')
+                    $browser->click('.more-loader button')
                         ->waitUntilMissing('.app-loader')
                         ->assertElementsCount('table tbody tr', 12)
-                        ->assertMissing('#transactions-loader button');
+                        ->assertMissing('.more-loader button');
 
                     $debitEntry = null;
                     foreach ($pages[1] as $idx => $transaction) {
                         $selector = 'table tbody tr:nth-child(' . ($idx + 1 + 10) . ')';
                         $priceStyle = $transaction->type == Transaction::WALLET_CREDIT ? 'text-success' : 'text-danger';
                         $browser->assertSeeIn("$selector td.description", $transaction->shortDescription());
 
                         if ($transaction->type == Transaction::WALLET_DEBIT) {
                             $debitEntry = $selector;
                         } else {
                             $browser->assertMissing("$selector td.selection button");
                         }
                     }
                 });
         });
     }
 }
diff --git a/src/tests/Feature/Backends/LDAPTest.php b/src/tests/Feature/Backends/LDAPTest.php
index 4c4ffe17..bc70a893 100644
--- a/src/tests/Feature/Backends/LDAPTest.php
+++ b/src/tests/Feature/Backends/LDAPTest.php
@@ -1,365 +1,389 @@
 <?php
 
 namespace Tests\Feature\Backends;
 
 use App\Backends\LDAP;
 use App\Domain;
 use App\Group;
 use App\Entitlement;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class LDAPTest extends TestCase
 {
     private $ldap_config = [];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->ldap_config = [
             'ldap.hosts' => \config('ldap.hosts'),
         ];
 
         $this->deleteTestUser('user-ldap-test@' . \config('app.domain'));
         $this->deleteTestDomain('testldap.com');
         $this->deleteTestGroup('group@kolab.org');
         // TODO: Remove group members
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         \config($this->ldap_config);
 
         $this->deleteTestUser('user-ldap-test@' . \config('app.domain'));
         $this->deleteTestDomain('testldap.com');
         $this->deleteTestGroup('group@kolab.org');
         // TODO: Remove group members
 
         parent::tearDown();
     }
 
     /**
      * Test handling connection errors
      *
      * @group ldap
      */
     public function testConnectException(): void
     {
         \config(['ldap.hosts' => 'non-existing.host']);
 
         $this->expectException(\Exception::class);
 
         LDAP::connect();
     }
 
     /**
      * Test creating/updating/deleting a domain record
      *
      * @group ldap
      */
     public function testDomain(): void
     {
         Queue::fake();
 
         $domain = $this->getTestDomain('testldap.com', [
                 'type' => Domain::TYPE_EXTERNAL,
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
         ]);
 
         // Create the domain
         LDAP::createDomain($domain);
 
         $ldap_domain = LDAP::getDomain($domain->namespace);
 
         $expected = [
             'associateddomain' => $domain->namespace,
             'inetdomainstatus' => $domain->status,
             'objectclass' => [
                 'top',
                 'domainrelatedobject',
                 'inetdomain'
             ],
         ];
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_domain[$attr]) ? $ldap_domain[$attr] : null);
         }
 
         // TODO: Test other attributes, aci, roles/ous
 
         // Update the domain
         $domain->status |= User::STATUS_LDAP_READY;
 
         LDAP::updateDomain($domain);
 
         $expected['inetdomainstatus'] = $domain->status;
 
         $ldap_domain = LDAP::getDomain($domain->namespace);
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_domain[$attr]) ? $ldap_domain[$attr] : null);
         }
 
         // Delete the domain
         LDAP::deleteDomain($domain);
 
         $this->assertSame(null, LDAP::getDomain($domain->namespace));
     }
 
     /**
      * Test creating/updating/deleting a group record
      *
      * @group ldap
      */
     public function testGroup(): void
     {
         Queue::fake();
 
         $root_dn = \config('ldap.hosted.root_dn');
         $group = $this->getTestGroup('group@kolab.org', [
                 'members' => ['member1@testldap.com', 'member2@testldap.com']
         ]);
+        $group->setSetting('sender_policy', '["test.com"]');
 
         // Create the group
         LDAP::createGroup($group);
 
         $ldap_group = LDAP::getGroup($group->email);
 
         $expected = [
             'cn' => 'group',
             'dn' => 'cn=group,ou=Groups,ou=kolab.org,' . $root_dn,
             'mail' => $group->email,
             'objectclass' => [
                 'top',
                 'groupofuniquenames',
                 'kolabgroupofuniquenames'
             ],
+            'kolaballowsmtpsender' => 'test.com',
             'uniquemember' => [
                 'uid=member1@testldap.com,ou=People,ou=kolab.org,' . $root_dn,
                 'uid=member2@testldap.com,ou=People,ou=kolab.org,' . $root_dn,
             ],
         ];
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_group[$attr]) ? $ldap_group[$attr] : null, "Group $attr attribute");
         }
 
         // Update members
         $group->members = ['member3@testldap.com'];
         $group->save();
+        $group->setSetting('sender_policy', '["test.com","-"]');
 
         LDAP::updateGroup($group);
 
         // TODO: Should we force this to be always an array?
         $expected['uniquemember'] = 'uid=member3@testldap.com,ou=People,ou=kolab.org,' . $root_dn;
+        $expected['kolaballowsmtpsender'] = ['test.com', '-'];
 
         $ldap_group = LDAP::getGroup($group->email);
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_group[$attr]) ? $ldap_group[$attr] : null, "Group $attr attribute");
         }
 
         $this->assertSame(['member3@testldap.com'], $group->fresh()->members);
 
         // Update members (add non-existing local member, expect it to be aot-removed from the group)
         $group->members = ['member3@testldap.com', 'member-local@kolab.org'];
         $group->save();
+        $group->setSetting('sender_policy', null);
 
         LDAP::updateGroup($group);
 
         // TODO: Should we force this to be always an array?
         $expected['uniquemember'] = 'uid=member3@testldap.com,ou=People,ou=kolab.org,' . $root_dn;
+        $expected['kolaballowsmtpsender'] = null;
 
         $ldap_group = LDAP::getGroup($group->email);
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_group[$attr]) ? $ldap_group[$attr] : null, "Group $attr attribute");
         }
 
         $this->assertSame(['member3@testldap.com'], $group->fresh()->members);
 
-        // We called save() twice, so we expect two update obs, this is making sure
-        // that there's no job executed by the LDAP backend
-        Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 2);
+        // We called save() twice, and setSettings() three times,
+        // this is making sure that there's no job executed by the LDAP backend
+        Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 5);
 
         // Delete the domain
         LDAP::deleteGroup($group);
 
         $this->assertSame(null, LDAP::getGroup($group->email));
     }
 
     /**
      * Test creating/editing/deleting a user record
      *
      * @group ldap
      */
     public function testUser(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-ldap-test@' . \config('app.domain'));
 
         LDAP::createUser($user);
 
         $ldap_user = LDAP::getUser($user->email);
 
         $expected = [
             'objectclass' => [
                 'top',
                 'inetorgperson',
                 'inetuser',
                 'kolabinetorgperson',
                 'mailrecipient',
                 'person',
                 'organizationalPerson',
             ],
             'mail' => $user->email,
             'uid' => $user->email,
             'nsroledn' => [
                 'cn=imap-user,' . \config('ldap.hosted.root_dn')
             ],
             'cn' => 'unknown',
             'displayname' => '',
             'givenname' => '',
             'sn' => 'unknown',
             'inetuserstatus' => $user->status,
             'mailquota' => null,
             'o' => '',
             'alias' => null,
         ];
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_user[$attr]) ? $ldap_user[$attr] : null);
         }
 
         // Add aliases, and change some user settings, and entitlements
         $user->setSettings([
             'first_name' => 'Firstname',
             'last_name' => 'Lastname',
             'organization' => 'Org',
             'country' => 'PL',
         ]);
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
         $aliases = ['t1-' . $user->email, 't2-' . $user->email];
         $user->setAliases($aliases);
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $user->assignPackage($package_kolab);
 
         LDAP::updateUser($user->fresh());
 
         $expected['alias'] = $aliases;
         $expected['o'] = 'Org';
         $expected['displayname'] = 'Lastname, Firstname';
         $expected['givenname'] = 'Firstname';
         $expected['cn'] = 'Firstname Lastname';
         $expected['sn'] = 'Lastname';
         $expected['inetuserstatus'] = $user->status;
         $expected['mailquota'] = 5242880;
         $expected['nsroledn'] = null;
 
         $ldap_user = LDAP::getUser($user->email);
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_user[$attr]) ? $ldap_user[$attr] : null);
         }
 
         // Update entitlements
         $sku_activesync = \App\Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $sku_groupware = \App\Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $user->assignSku($sku_activesync, 1);
         Entitlement::where(['sku_id' => $sku_groupware->id, 'entitleable_id' => $user->id])->delete();
 
         LDAP::updateUser($user->fresh());
 
         $expected_roles = [
             'activesync-user',
             'imap-user'
         ];
 
         $ldap_user = LDAP::getUser($user->email);
 
         $this->assertCount(2, $ldap_user['nsroledn']);
 
         $ldap_roles = array_map(
             function ($role) {
                 if (preg_match('/^cn=([a-z0-9-]+)/', $role, $m)) {
                     return $m[1];
                 } else {
                     return $role;
                 }
             },
             $ldap_user['nsroledn']
         );
 
         $this->assertSame($expected_roles, $ldap_roles);
 
         // Delete the user
         LDAP::deleteUser($user);
 
         $this->assertSame(null, LDAP::getUser($user->email));
     }
 
     /**
      * Test handling errors on user creation
      *
      * @group ldap
      */
     public function testCreateUserException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/Failed to create user/');
 
         $user = new User([
                 'email' => 'test-non-existing-ldap@non-existing.org',
                 'status' => User::STATUS_ACTIVE,
         ]);
 
         LDAP::createUser($user);
     }
 
     /**
      * Test handling update of a non-existing domain
      *
      * @group ldap
      */
     public function testUpdateDomainException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/domain not found/');
 
         $domain = new Domain([
                 'namespace' => 'testldap.com',
                 'type' => Domain::TYPE_EXTERNAL,
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
         ]);
 
         LDAP::updateDomain($domain);
     }
 
+    /**
+     * Test handling update of a non-existing group
+     *
+     * @group ldap
+     */
+    public function testUpdateGroupException(): void
+    {
+        $this->expectException(\Exception::class);
+        $this->expectExceptionMessageMatches('/group not found/');
+
+        $group = new Group([
+                'email' => 'test@testldap.com',
+                'status' => Group::STATUS_NEW | Group::STATUS_ACTIVE,
+        ]);
+
+        LDAP::updateGroup($group);
+    }
+
     /**
      * Test handling update of a non-existing user
      *
      * @group ldap
      */
     public function testUpdateUserException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/user not found/');
 
         $user = new User([
                 'email' => 'test-non-existing-ldap@kolab.org',
                 'status' => User::STATUS_ACTIVE,
         ]);
 
         LDAP::updateUser($user);
     }
 }
diff --git a/src/tests/Feature/Controller/GroupsTest.php b/src/tests/Feature/Controller/GroupsTest.php
index eaceab19..d5bc9327 100644
--- a/src/tests/Feature/Controller/GroupsTest.php
+++ b/src/tests/Feature/Controller/GroupsTest.php
@@ -1,492 +1,571 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Group;
 use App\Http\Controllers\API\V4\GroupsController;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class GroupsTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestGroup('group-test@kolab.org');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestGroup('group-test@kolab.org');
 
         parent::tearDown();
     }
 
     /**
      * Test group deleting (DELETE /api/v4/groups/<id>)
      */
     public function testDestroy(): void
     {
         // First create some groups to delete
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
 
         // Test unauth access
         $response = $this->delete("api/v4/groups/{$group->id}");
         $response->assertStatus(401);
 
         // Test non-existing group
         $response = $this->actingAs($john)->delete("api/v4/groups/abc");
         $response->assertStatus(404);
 
         // Test access to other user's group
         $response = $this->actingAs($jack)->delete("api/v4/groups/{$group->id}");
         $response->assertStatus(403);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("Access denied", $json['message']);
         $this->assertCount(2, $json);
 
         // Test removing a group
         $response = $this->actingAs($john)->delete("api/v4/groups/{$group->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals("Distribution list deleted successfully.", $json['message']);
     }
 
     /**
      * Test groups listing (GET /api/v4/groups)
      */
     public function testIndex(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
 
         // Test unauth access
         $response = $this->get("api/v4/groups");
         $response->assertStatus(401);
 
         // Test a user with no groups
         $response = $this->actingAs($jack)->get("/api/v4/groups");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(0, $json);
 
         // Test a user with a single group
         $response = $this->actingAs($john)->get("/api/v4/groups");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(1, $json);
         $this->assertSame($group->id, $json[0]['id']);
         $this->assertSame($group->email, $json[0]['email']);
         $this->assertArrayHasKey('isDeleted', $json[0]);
         $this->assertArrayHasKey('isSuspended', $json[0]);
         $this->assertArrayHasKey('isActive', $json[0]);
         $this->assertArrayHasKey('isLdapReady', $json[0]);
 
         // Test that another wallet controller has access to groups
         $response = $this->actingAs($ned)->get("/api/v4/groups");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(1, $json);
         $this->assertSame($group->email, $json[0]['email']);
     }
 
+    /**
+     * Test group config update (POST /api/v4/groups/<group>/config)
+     */
+    public function testSetConfig(): void
+    {
+        $john = $this->getTestUser('john@kolab.org');
+        $jack = $this->getTestUser('jack@kolab.org');
+        $group = $this->getTestGroup('group-test@kolab.org');
+        $group->assignToWallet($john->wallets->first());
+
+        // Test unknown group id
+        $post = ['sender_policy' => []];
+        $response = $this->actingAs($john)->post("/api/v4/groups/123/config", $post);
+        $json = $response->json();
+
+        $response->assertStatus(404);
+
+        // Test access by user not being a wallet controller
+        $post = ['sender_policy' => []];
+        $response = $this->actingAs($jack)->post("/api/v4/groups/{$group->id}/config", $post);
+        $json = $response->json();
+
+        $response->assertStatus(403);
+
+        $this->assertSame('error', $json['status']);
+        $this->assertSame("Access denied", $json['message']);
+        $this->assertCount(2, $json);
+
+        // Test some invalid data
+        $post = ['test' => 1];
+        $response = $this->actingAs($john)->post("/api/v4/groups/{$group->id}/config", $post);
+        $response->assertStatus(422);
+
+        $json = $response->json();
+
+        $this->assertSame('error', $json['status']);
+        $this->assertCount(2, $json);
+        $this->assertCount(1, $json['errors']);
+        $this->assertSame('The requested configuration parameter is not supported.', $json['errors']['test']);
+
+        $group->refresh();
+
+        $this->assertNull($group->getSetting('test'));
+        $this->assertNull($group->getSetting('sender_policy'));
+
+        // Test some valid data
+        $post = ['sender_policy' => ['domain.com']];
+        $response = $this->actingAs($john)->post("/api/v4/groups/{$group->id}/config", $post);
+
+        $response->assertStatus(200);
+
+        $json = $response->json();
+
+        $this->assertCount(2, $json);
+        $this->assertSame('success', $json['status']);
+        $this->assertSame('Distribution list settings updated successfully.', $json['message']);
+
+        $this->assertSame(['sender_policy' => $post['sender_policy']], $group->fresh()->getConfig());
+
+        // Test input validation
+        $post = ['sender_policy' => [5]];
+        $response = $this->actingAs($john)->post("/api/v4/groups/{$group->id}/config", $post);
+        $response->assertStatus(422);
+
+        $json = $response->json();
+
+        $this->assertCount(2, $json);
+        $this->assertSame('error', $json['status']);
+        $this->assertCount(1, $json['errors']);
+        $this->assertSame(
+            'The entry format is invalid. Expected an email, domain, or part of it.',
+            $json['errors']['sender_policy'][0]
+        );
+
+        $this->assertSame(['sender_policy' => ['domain.com']], $group->fresh()->getConfig());
+    }
+
     /**
      * Test fetching group data/profile (GET /api/v4/groups/<group-id>)
      */
     public function testShow(): void
     {
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
+        $group->setSetting('sender_policy', '["test"]');
 
         // Test unauthorized access to a profile of other user
         $response = $this->get("/api/v4/groups/{$group->id}");
         $response->assertStatus(401);
 
         // Test unauthorized access to a group of another user
         $response = $this->actingAs($jack)->get("/api/v4/groups/{$group->id}");
         $response->assertStatus(403);
 
         // John: Group owner - non-existing group
         $response = $this->actingAs($john)->get("/api/v4/groups/abc");
         $response->assertStatus(404);
 
         // John: Group owner
         $response = $this->actingAs($john)->get("/api/v4/groups/{$group->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame($group->id, $json['id']);
         $this->assertSame($group->email, $json['email']);
         $this->assertSame($group->members, $json['members']);
         $this->assertTrue(!empty($json['statusInfo']));
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isLdapReady', $json);
+        $this->assertSame(['sender_policy' => ['test']], $json['config']);
     }
 
     /**
      * Test fetching group status (GET /api/v4/groups/<group-id>/status)
      * and forcing setup process update (?refresh=1)
      */
     public function testStatus(): void
     {
         Queue::fake();
 
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
 
         // Test unauthorized access
         $response = $this->get("/api/v4/groups/abc/status");
         $response->assertStatus(401);
 
         // Test unauthorized access
         $response = $this->actingAs($jack)->get("/api/v4/groups/{$group->id}/status");
         $response->assertStatus(403);
 
         $group->status = Group::STATUS_NEW | Group::STATUS_ACTIVE;
         $group->save();
 
         // Get group status
         $response = $this->actingAs($john)->get("/api/v4/groups/{$group->id}/status");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isLdapReady']);
         $this->assertFalse($json['isReady']);
         $this->assertFalse($json['isSuspended']);
         $this->assertTrue($json['isActive']);
         $this->assertFalse($json['isDeleted']);
         $this->assertCount(6, $json['process']);
         $this->assertSame('distlist-new', $json['process'][0]['label']);
         $this->assertSame(true, $json['process'][0]['state']);
         $this->assertSame('distlist-ldap-ready', $json['process'][1]['label']);
         $this->assertSame(false, $json['process'][1]['state']);
         $this->assertTrue(empty($json['status']));
         $this->assertTrue(empty($json['message']));
 
         // Make sure the domain is confirmed (other test might unset that status)
         $domain = $this->getTestDomain('kolab.org');
         $domain->status |= \App\Domain::STATUS_CONFIRMED;
         $domain->save();
 
         // Now "reboot" the process and  the group
         $response = $this->actingAs($john)->get("/api/v4/groups/{$group->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue($json['isLdapReady']);
         $this->assertTrue($json['isReady']);
         $this->assertCount(6, $json['process']);
         $this->assertSame('distlist-ldap-ready', $json['process'][1]['label']);
         $this->assertSame(true, $json['process'][1]['state']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Setup process finished successfully.', $json['message']);
 
         // Test a case when a domain is not ready
         $domain->status ^= \App\Domain::STATUS_CONFIRMED;
         $domain->save();
 
         $response = $this->actingAs($john)->get("/api/v4/groups/{$group->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue($json['isLdapReady']);
         $this->assertTrue($json['isReady']);
         $this->assertCount(6, $json['process']);
         $this->assertSame('distlist-ldap-ready', $json['process'][1]['label']);
         $this->assertSame(true, $json['process'][1]['state']);
         $this->assertSame('success', $json['status']);
         $this->assertSame('Setup process finished successfully.', $json['message']);
     }
 
     /**
      * Test GroupsController::statusInfo()
      */
     public function testStatusInfo(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
         $group->status = Group::STATUS_NEW | Group::STATUS_ACTIVE;
         $group->save();
 
         $result = GroupsController::statusInfo($group);
 
         $this->assertFalse($result['isReady']);
         $this->assertCount(6, $result['process']);
         $this->assertSame('distlist-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('distlist-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(false, $result['process'][1]['state']);
         $this->assertSame('running', $result['processState']);
 
         $group->created_at = Carbon::now()->subSeconds(181);
         $group->save();
 
         $result = GroupsController::statusInfo($group);
 
         $this->assertSame('failed', $result['processState']);
 
         $group->status |= Group::STATUS_LDAP_READY;
         $group->save();
 
         $result = GroupsController::statusInfo($group);
 
         $this->assertTrue($result['isReady']);
         $this->assertCount(6, $result['process']);
         $this->assertSame('distlist-new', $result['process'][0]['label']);
         $this->assertSame(true, $result['process'][0]['state']);
         $this->assertSame('distlist-ldap-ready', $result['process'][1]['label']);
         $this->assertSame(true, $result['process'][2]['state']);
         $this->assertSame('done', $result['processState']);
     }
 
     /**
      * Test group creation (POST /api/v4/groups)
      */
     public function testStore(): void
     {
         Queue::fake();
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
 
         // Test unauth request
         $response = $this->post("/api/v4/groups", []);
         $response->assertStatus(401);
 
         // Test non-controller user
         $response = $this->actingAs($jack)->post("/api/v4/groups", []);
         $response->assertStatus(403);
 
         // Test empty request
         $response = $this->actingAs($john)->post("/api/v4/groups", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("The email field is required.", $json['errors']['email']);
         $this->assertCount(2, $json);
 
         // Test missing members
         $post = ['email' => 'group-test@kolab.org'];
         $response = $this->actingAs($john)->post("/api/v4/groups", $post);
         $json = $response->json();
 
         $response->assertStatus(422);
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("At least one recipient is required.", $json['errors']['members']);
         $this->assertCount(2, $json);
 
         // Test invalid email
         $post = ['email' => 'invalid'];
         $response = $this->actingAs($john)->post("/api/v4/groups", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified email is invalid.', $json['errors']['email']);
 
         // Test successful group creation
         $post = [
             'email' => 'group-test@kolab.org',
             'members' => ['test1@domain.tld', 'test2@domain.tld']
         ];
 
         $response = $this->actingAs($john)->post("/api/v4/groups", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("Distribution list created successfully.", $json['message']);
         $this->assertCount(2, $json);
 
         $group = Group::where('email', 'group-test@kolab.org')->first();
         $this->assertInstanceOf(Group::class, $group);
         $this->assertSame($post['email'], $group->email);
         $this->assertSame($post['members'], $group->members);
         $this->assertTrue($john->groups()->get()->contains($group));
     }
 
     /**
      * Test group update (PUT /api/v4/groups/<group-id>)
      */
     public function testUpdate(): void
     {
         Queue::fake();
 
         $jack = $this->getTestUser('jack@kolab.org');
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $group = $this->getTestGroup('group-test@kolab.org');
         $group->assignToWallet($john->wallets->first());
 
         // Test unauthorized update
         $response = $this->get("/api/v4/groups/{$group->id}", []);
         $response->assertStatus(401);
 
         // Test unauthorized update
         $response = $this->actingAs($jack)->get("/api/v4/groups/{$group->id}", []);
         $response->assertStatus(403);
 
         // Test updating - missing members
         $response = $this->actingAs($john)->put("/api/v4/groups/{$group->id}", []);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertSame("At least one recipient is required.", $json['errors']['members']);
         $this->assertCount(2, $json);
 
         // Test some invalid data
         $post = ['members' => ['test@domain.tld', 'invalid']];
         $response = $this->actingAs($john)->put("/api/v4/groups/{$group->id}", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json);
         $this->assertSame('The specified email address is invalid.', $json['errors']['members'][1]);
 
         // Valid data - members changed
         $post = [
             'members' => ['member1@test.domain', 'member2@test.domain']
         ];
 
         $response = $this->actingAs($john)->put("/api/v4/groups/{$group->id}", $post);
         $json = $response->json();
 
         $response->assertStatus(200);
 
         $this->assertSame('success', $json['status']);
         $this->assertSame("Distribution list updated successfully.", $json['message']);
         $this->assertCount(2, $json);
         $this->assertSame($group->fresh()->members, $post['members']);
     }
 
     /**
      * Group email address validation.
      */
     public function testValidateGroupEmail(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $group = $this->getTestGroup('group-test@kolab.org');
 
         // Invalid email
         $result = GroupsController::validateGroupEmail('', $john);
         $this->assertSame("The email field is required.", $result);
 
         $result = GroupsController::validateGroupEmail('kolab.org', $john);
         $this->assertSame("The specified email is invalid.", $result);
 
         $result = GroupsController::validateGroupEmail('.@kolab.org', $john);
         $this->assertSame("The specified email is invalid.", $result);
 
         $result = GroupsController::validateGroupEmail('test123456@localhost', $john);
         $this->assertSame("The specified domain is invalid.", $result);
 
         $result = GroupsController::validateGroupEmail('test123456@unknown-domain.org', $john);
         $this->assertSame("The specified domain is invalid.", $result);
 
         // forbidden public domain
         $result = GroupsController::validateGroupEmail('testtest@kolabnow.com', $john);
         $this->assertSame("The specified domain is not available.", $result);
 
         // existing alias
         $result = GroupsController::validateGroupEmail('jack.daniels@kolab.org', $john);
         $this->assertSame("The specified email is not available.", $result);
 
         // existing user
         $result = GroupsController::validateGroupEmail('ned@kolab.org', $john);
         $this->assertSame("The specified email is not available.", $result);
 
         // existing group
         $result = GroupsController::validateGroupEmail('group-test@kolab.org', $john);
         $this->assertSame("The specified email is not available.", $result);
 
         // valid
         $result = GroupsController::validateGroupEmail('admin@kolab.org', $john);
         $this->assertSame(null, $result);
     }
 
     /**
      * Group member email address validation.
      */
     public function testValidateMemberEmail(): void
     {
         $john = $this->getTestUser('john@kolab.org');
 
         // Invalid format
         $result = GroupsController::validateMemberEmail('kolab.org', $john);
         $this->assertSame("The specified email address is invalid.", $result);
 
         $result = GroupsController::validateMemberEmail('.@kolab.org', $john);
         $this->assertSame("The specified email address is invalid.", $result);
 
         $result = GroupsController::validateMemberEmail('test123456@localhost', $john);
         $this->assertSame("The specified email address is invalid.", $result);
 
         // Test local non-existing user
         $result = GroupsController::validateMemberEmail('unknown@kolab.org', $john);
         $this->assertSame("The specified email address does not exist.", $result);
 
         // Test local existing user
         $result = GroupsController::validateMemberEmail('ned@kolab.org', $john);
         $this->assertSame(null, $result);
 
         // Test existing user, but not in the same account
         $result = GroupsController::validateMemberEmail('jeroen@jeroen.jeroen', $john);
         $this->assertSame(null, $result);
 
         // Valid address
         $result = GroupsController::validateMemberEmail('test@google.com', $john);
         $this->assertSame(null, $result);
     }
 }
diff --git a/src/tests/Feature/GroupTest.php b/src/tests/Feature/GroupTest.php
index 9415eb85..da848d86 100644
--- a/src/tests/Feature/GroupTest.php
+++ b/src/tests/Feature/GroupTest.php
@@ -1,266 +1,348 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Group;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class GroupTest extends TestCase
 {
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('user-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
     }
 
     public function tearDown(): void
     {
         $this->deleteTestUser('user-test@kolabnow.com');
         $this->deleteTestGroup('group-test@kolabnow.com');
 
         parent::tearDown();
     }
 
     /**
      * Tests for Group::assignToWallet()
      */
     public function testAssignToWallet(): void
     {
         $user = $this->getTestUser('user-test@kolabnow.com');
         $group = $this->getTestGroup('group-test@kolabnow.com');
 
         $result = $group->assignToWallet($user->wallets->first());
 
         $this->assertSame($group, $result);
         $this->assertSame(1, $group->entitlements()->count());
 
         // Can't be done twice on the same group
         $this->expectException(\Exception::class);
         $result->assignToWallet($user->wallets->first());
     }
 
+    /**
+     * Test Group::getConfig() and setConfig() methods
+     */
+    public function testConfigTrait(): void
+    {
+        $group = $this->getTestGroup('group-test@kolabnow.com');
+
+        $group->setSetting('sender_policy', '["test","-"]');
+
+        $this->assertSame(['sender_policy' => ['test']], $group->getConfig());
+
+        $result = $group->setConfig(['sender_policy' => [], 'unknown' => false]);
+
+        $this->assertSame(['sender_policy' => []], $group->getConfig());
+        $this->assertSame('[]', $group->getSetting('sender_policy'));
+        $this->assertSame(['unknown' => "The requested configuration parameter is not supported."], $result);
+
+        $result = $group->setConfig(['sender_policy' => ['test']]);
+
+        $this->assertSame(['sender_policy' => ['test']], $group->getConfig());
+        $this->assertSame('["test","-"]', $group->getSetting('sender_policy'));
+        $this->assertSame([], $result);
+    }
+
     /**
      * Test group status assignment and is*() methods
      */
     public function testStatus(): void
     {
         $group = new Group();
 
         $this->assertSame(false, $group->isNew());
         $this->assertSame(false, $group->isActive());
         $this->assertSame(false, $group->isDeleted());
         $this->assertSame(false, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status = Group::STATUS_NEW;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(false, $group->isActive());
         $this->assertSame(false, $group->isDeleted());
         $this->assertSame(false, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status |= Group::STATUS_ACTIVE;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(true, $group->isActive());
         $this->assertSame(false, $group->isDeleted());
         $this->assertSame(false, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status |= Group::STATUS_LDAP_READY;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(true, $group->isActive());
         $this->assertSame(false, $group->isDeleted());
         $this->assertSame(true, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status |= Group::STATUS_DELETED;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(true, $group->isActive());
         $this->assertSame(true, $group->isDeleted());
         $this->assertSame(true, $group->isLdapReady());
         $this->assertSame(false, $group->isSuspended());
 
         $group->status |= Group::STATUS_SUSPENDED;
 
         $this->assertSame(true, $group->isNew());
         $this->assertSame(true, $group->isActive());
         $this->assertSame(true, $group->isDeleted());
         $this->assertSame(true, $group->isLdapReady());
         $this->assertSame(true, $group->isSuspended());
 
         // Unknown status value
         $this->expectException(\Exception::class);
         $group->status = 111;
     }
 
     /**
      * Test creating a group
      */
     public function testCreate(): void
     {
         Queue::fake();
 
         $group = Group::create(['email' => 'GROUP-test@kolabnow.com']);
 
         $this->assertSame('group-test@kolabnow.com', $group->email);
         $this->assertMatchesRegularExpression('/^[0-9]{1,20}$/', $group->id);
         $this->assertSame([], $group->members);
         $this->assertTrue($group->isNew());
         $this->assertTrue($group->isActive());
 
         Queue::assertPushed(
             \App\Jobs\Group\CreateJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 
     /**
      * Test group deletion and force-deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-test@kolabnow.com');
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->assignToWallet($user->wallets->first());
 
         $entitlements = \App\Entitlement::where('entitleable_id', $group->id);
 
         $this->assertSame(1, $entitlements->count());
 
         $group->delete();
 
         $this->assertTrue($group->fresh()->trashed());
         $this->assertSame(0, $entitlements->count());
         $this->assertSame(1, $entitlements->withTrashed()->count());
 
         $group->forceDelete();
 
         $this->assertSame(0, $entitlements->withTrashed()->count());
         $this->assertCount(0, Group::withTrashed()->where('id', $group->id)->get());
 
         Queue::assertPushed(\App\Jobs\Group\DeleteJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\Group\DeleteJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 
     /**
      * Tests for Group::emailExists()
      */
     public function testEmailExists(): void
     {
         Queue::fake();
 
         $group = $this->getTestGroup('group-test@kolabnow.com');
 
         $this->assertFalse(Group::emailExists('unknown@domain.tld'));
         $this->assertTrue(Group::emailExists($group->email));
 
         $result = Group::emailExists($group->email, true);
         $this->assertSame($result->id, $group->id);
 
         $group->delete();
 
         $this->assertTrue(Group::emailExists($group->email));
 
         $result = Group::emailExists($group->email, true);
         $this->assertSame($result->id, $group->id);
     }
 
+    /**
+     * Tests for GroupSettingsTrait functionality and GroupSettingObserver
+     */
+    public function testSettings(): void
+    {
+        Queue::fake();
+        Queue::assertNothingPushed();
+
+        $group = $this->getTestGroup('group-test@kolabnow.com');
+
+        Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 0);
+
+        // Add a setting
+        $group->setSetting('unknown', 'test');
+
+        Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 0);
+
+        // Add a setting that is synced to LDAP
+        $group->setSetting('sender_policy', '[]');
+
+        Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
+
+        // Note: We test both current group as well as fresh group object
+        //       to make sure cache works as expected
+        $this->assertSame('test', $group->getSetting('unknown'));
+        $this->assertSame('[]', $group->fresh()->getSetting('sender_policy'));
+
+        Queue::fake();
+
+        // Update a setting
+        $group->setSetting('unknown', 'test1');
+
+        Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 0);
+
+        // Update a setting that is synced to LDAP
+        $group->setSetting('sender_policy', '["-"]');
+
+        Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
+
+        $this->assertSame('test1', $group->getSetting('unknown'));
+        $this->assertSame('["-"]', $group->fresh()->getSetting('sender_policy'));
+
+        Queue::fake();
+
+        // Delete a setting (null)
+        $group->setSetting('unknown', null);
+
+        Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 0);
+
+        // Delete a setting that is synced to LDAP
+        $group->setSetting('sender_policy', null);
+
+        Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
+
+        $this->assertSame(null, $group->getSetting('unknown'));
+        $this->assertSame(null, $group->fresh()->getSetting('sender_policy'));
+    }
+
     /**
      * Tests for Group::suspend()
      */
     public function testSuspend(): void
     {
         Queue::fake();
 
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->suspend();
 
         $this->assertTrue($group->isSuspended());
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\Group\UpdateJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 
     /**
      * Test updating a group
      */
     public function testUpdate(): void
     {
         Queue::fake();
 
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->status |= Group::STATUS_DELETED;
         $group->save();
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\Group\UpdateJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 
     /**
      * Tests for Group::unsuspend()
      */
     public function testUnsuspend(): void
     {
         Queue::fake();
 
         $group = $this->getTestGroup('group-test@kolabnow.com');
         $group->status = Group::STATUS_SUSPENDED;
         $group->unsuspend();
 
         $this->assertFalse($group->isSuspended());
 
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 1);
         Queue::assertPushed(
             \App\Jobs\Group\UpdateJob::class,
             function ($job) use ($group) {
                 $groupEmail = TestCase::getObjectProperty($job, 'groupEmail');
                 $groupId = TestCase::getObjectProperty($job, 'groupId');
 
                 return $groupEmail === $group->email
                     && $groupId === $group->id;
             }
         );
     }
 }