diff --git a/src/app/Backends/LDAP.php b/src/app/Backends/LDAP.php
index 0691d441..fc391888 100644
--- a/src/app/Backends/LDAP.php
+++ b/src/app/Backends/LDAP.php
@@ -1,734 +1,734 @@
 <?php
 
 namespace App\Backends;
 
 use App\Domain;
 use App\User;
 
 class LDAP
 {
     /** @const array UserSettings used by the backend */
     public const USER_SETTINGS = [
         'first_name',
         'last_name',
         'organization',
     ];
 
     /** @var ?\Net_LDAP3 LDAP connection object */
     protected static $ldap;
 
 
     /**
      * Starts a new LDAP connection that will be used by all methods
      * until you call self::disconnect() explicitely. Normally every
      * method uses a separate connection.
      *
      * @throws \Exception
      */
     public static function connect(): void
     {
         if (empty(self::$ldap)) {
             $config = self::getConfig('admin');
             self::$ldap = self::initLDAP($config);
         }
     }
 
     /**
      * Close the connection created by self::connect()
      */
     public static function disconnect(): void
     {
         if (!empty(self::$ldap)) {
             self::$ldap->close();
             self::$ldap = null;
         }
     }
 
     /**
      * Create a domain in LDAP.
      *
      * @param \App\Domain $domain The domain to create.
      *
      * @throws \Exception
      */
     public static function createDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
         $mgmtRootDN = \config('ldap.admin.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         $aci = [
             '(targetattr = "*")'
             . '(version 3.0; acl "Deny Unauthorized"; deny (all)'
             . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)") '
             . 'AND NOT roledn = "ldap:///cn=kolab-admin,' . $mgmtRootDN . '";)',
 
             '(targetattr != "userPassword")'
             . '(version 3.0;acl "Search Access";allow (read,compare,search)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)");)',
 
             '(targetattr = "*")'
             . '(version 3.0;acl "Kolab Administrators";allow (all)'
             . '(roledn = "ldap:///cn=kolab-admin,' . $domainBaseDN
             . ' || ldap:///cn=kolab-admin,' . $mgmtRootDN . '");)'
         ];
 
         $entry = [
             'aci' => $aci,
             'associateddomain' => $domain->namespace,
             'inetdomainbasedn' => $domainBaseDN,
             'objectclass' => [
                 'top',
                 'domainrelatedobject',
                 'inetdomain'
             ],
         ];
 
         $dn = "associateddomain={$domain->namespace},{$config['domain_base_dn']}";
 
         self::setDomainAttributes($domain, $entry);
 
         if (!$ldap->get_entry($dn)) {
             $result = $ldap->add_entry($dn, $entry);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         // create ou, roles, ous
         $entry = [
             'description' => $domain->namespace,
             'objectclass' => [
                 'top',
                 'organizationalunit'
             ],
             'ou' => $domain->namespace,
         ];
 
         $entry['aci'] = array(
             '(targetattr = "*")'
             . '(version 3.0;acl "Deny Unauthorized"; deny (all)'
             . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)") '
             . 'AND NOT roledn = "ldap:///cn=kolab-admin,' . $mgmtRootDN . '";)',
 
             '(targetattr != "userPassword")'
             . '(version 3.0;acl "Search Access";allow (read,compare,search,write)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)");)',
 
             '(targetattr = "*")'
             . '(version 3.0;acl "Kolab Administrators";allow (all)'
             . '(roledn = "ldap:///cn=kolab-admin,' . $domainBaseDN
             . ' || ldap:///cn=kolab-admin,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///ou=*,' . $domainBaseDN . '")'
             . '(targetattr="objectclass || aci || ou")'
             . '(version 3.0;acl "Allow Domain sub-OU Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///uid=*,ou=People,' . $domainBaseDN . '")(targetattr="*")'
             . '(version 3.0;acl "Allow Domain First User Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///cn=*,' . $domainBaseDN . '")(targetattr="objectclass || cn")'
             . '(version 3.0;acl "Allow Domain Role Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
         );
 
         if (!$ldap->get_entry($domainBaseDN)) {
             $result = $ldap->add_entry($domainBaseDN, $entry);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         foreach (['Groups', 'People', 'Resources', 'Shared Folders'] as $item) {
             if (!$ldap->get_entry("ou={$item},{$domainBaseDN}")) {
                 $result = $ldap->add_entry(
                     "ou={$item},{$domainBaseDN}",
                     [
                         'ou' => $item,
                         'description' => $item,
                         'objectclass' => [
                             'top',
                             'organizationalunit'
                         ]
                     ]
                 );
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         foreach (['kolab-admin'] as $item) {
             if (!$ldap->get_entry("cn={$item},{$domainBaseDN}")) {
                 $result = $ldap->add_entry(
                     "cn={$item},{$domainBaseDN}",
                     [
                         'cn' => $item,
                         'description' => "{$item} role",
                         'objectclass' => [
                             'top',
                             'ldapsubentry',
                             'nsmanagedroledefinition',
                             'nsroledefinition',
                             'nssimpleroledefinition'
                         ]
                     ]
                 );
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         // TODO: Assign kolab-admin role to the owner?
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Create a user in LDAP.
      *
      * Only need to add user if in any of the local domains? Figure that out here for now. Should
      * have Context-Based Access Controls before the job is queued though, probably.
      *
      * Use one of three modes;
      *
      * 1) The authenticated user account.
      *
      *    * Only valid if the authenticated user is a domain admin.
      *    * We don't know the originating user here.
      *    * We certainly don't have its password anymore.
      *
      * 2) The hosted kolab account.
      *
      * 3) The Directory Manager account.
      *
      * @param \App\User $user The user account to create.
      *
      * @throws \Exception
      */
     public static function createUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $entry = [
             'objectclass' => [
                 'top',
                 'inetorgperson',
                 'inetuser',
                 'kolabinetorgperson',
                 'mailrecipient',
                 'person'
             ],
             'mail' => $user->email,
             'uid' => $user->email,
             'nsroledn' => []
         ];
 
         if (!self::getUserEntry($ldap, $user->email, $dn)) {
             if (empty($dn)) {
-                self::throwException($ldap, "Failed to create user {$user->email} in LDAP");
+                self::throwException($ldap, "Failed to create user {$user->email} in LDAP (" . __LINE__ . ")");
             }
 
             self::setUserAttributes($user, $entry);
 
             $result = $ldap->add_entry($dn, $entry);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to create user {$user->email} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a domain from LDAP.
      *
      * @param \App\Domain $domain The domain to update.
      *
      * @throws \Exception
      */
     public static function deleteDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
         $mgmtRootDN = \config('ldap.admin.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         if ($ldap->get_entry($domainBaseDN)) {
             $result = $ldap->delete_entry_recursive($domainBaseDN);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete domain {$domain->namespace} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if ($ldap_domain = $ldap->find_domain($domain->namespace)) {
             if ($ldap->get_entry($ldap_domain['dn'])) {
                 $result = $ldap->delete_entry($ldap_domain['dn']);
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to delete domain {$domain->namespace} from LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a user from LDAP.
      *
      * @param \App\User $user The user account to update.
      *
      * @throws \Exception
      */
     public static function deleteUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         if (self::getUserEntry($ldap, $user->email, $dn)) {
             $result = $ldap->delete_entry($dn);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete user {$user->email} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Get a domain data from LDAP.
      *
      * @param string $namespace The domain name
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getDomain(string $namespace)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $ldapDomain = $ldap->find_domain($namespace);
 
         if ($ldapDomain) {
             $domain = $ldap->get_entry($ldapDomain['dn']);
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $domain ?? null;
     }
 
     /**
      * Get a user data from LDAP.
      *
      * @param string $email The user email.
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getUser(string $email)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $user = self::getUserEntry($ldap, $email, $dn, true);
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $user;
     }
 
     /**
      * Update a domain in LDAP.
      *
      * @param \App\Domain $domain The domain to update.
      *
      * @throws \Exception
      */
     public static function updateDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $ldapDomain = $ldap->find_domain($domain->namespace);
 
         if (!$ldapDomain) {
             self::throwException(
                 $ldap,
                 "Failed to update domain {$domain->namespace} in LDAP (domain not found)"
             );
         }
 
         $oldEntry = $ldap->get_entry($ldapDomain['dn']);
         $newEntry = $oldEntry;
 
         self::setDomainAttributes($domain, $newEntry);
 
         if (array_key_exists('inetdomainstatus', $newEntry)) {
             $newEntry['inetdomainstatus'] = (string) $newEntry['inetdomainstatus'];
         }
 
         $result = $ldap->modify_entry($ldapDomain['dn'], $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Update a user in LDAP.
      *
      * @param \App\User $user The user account to update.
      *
      * @throws \Exception
      */
     public static function updateUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $newEntry = $oldEntry = self::getUserEntry($ldap, $user->email, $dn, true);
 
         if (!$oldEntry) {
             self::throwException(
                 $ldap,
                 "Failed to update user {$user->email} in LDAP (user not found)"
             );
         }
 
         self::setUserAttributes($user, $newEntry);
 
         if (array_key_exists('objectclass', $newEntry)) {
             if (!in_array('inetuser', $newEntry['objectclass'])) {
                 $newEntry['objectclass'][] = 'inetuser';
             }
         }
 
         if (array_key_exists('inetuserstatus', $newEntry)) {
             $newEntry['inetuserstatus'] = (string) $newEntry['inetuserstatus'];
         }
 
         if (array_key_exists('mailquota', $newEntry)) {
             $newEntry['mailquota'] = (string) $newEntry['mailquota'];
         }
 
         $result = $ldap->modify_entry($dn, $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update user {$user->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Initialize connection to LDAP
      */
     private static function initLDAP(array $config, string $privilege = 'admin')
     {
         if (self::$ldap) {
             return self::$ldap;
         }
 
         $ldap = new \Net_LDAP3($config);
 
         $connected = $ldap->connect();
 
         if (!$connected) {
             throw new \Exception("Failed to connect to LDAP");
         }
 
         $bound = $ldap->bind(
             \config("ldap.{$privilege}.bind_dn"),
             \config("ldap.{$privilege}.bind_pw")
         );
 
         if (!$bound) {
             throw new \Exception("Failed to bind to LDAP");
         }
 
         return $ldap;
     }
 
     /**
      * Set domain attributes
      */
     private static function setDomainAttributes(Domain $domain, array &$entry)
     {
         $entry['inetdomainstatus'] = $domain->status;
     }
 
     /**
      * Set common user attributes
      */
     private static function setUserAttributes(User $user, array &$entry)
     {
         $firstName = $user->getSetting('first_name');
         $lastName = $user->getSetting('last_name');
 
         $cn = "unknown";
         $displayname = "";
 
         if ($firstName) {
             if ($lastName) {
                 $cn = "{$firstName} {$lastName}";
                 $displayname = "{$lastName}, {$firstName}";
             } else {
                 $lastName = "unknown";
                 $cn = "{$firstName}";
                 $displayname = "{$firstName}";
             }
         } else {
             $firstName = "";
             if ($lastName) {
                 $cn = "{$lastName}";
                 $displayname = "{$lastName}";
             } else {
                 $lastName = "unknown";
             }
         }
 
         $entry['cn'] = $cn;
         $entry['displayname'] = $displayname;
         $entry['givenname'] = $firstName;
         $entry['sn'] = $lastName;
         $entry['userpassword'] = $user->password_ldap;
         $entry['inetuserstatus'] = $user->status;
         $entry['o'] = $user->getSetting('organization');
         $entry['mailquota'] = 0;
         $entry['alias'] = $user->aliases->pluck('alias')->toArray();
 
         $roles = [];
 
         foreach ($user->entitlements as $entitlement) {
             \Log::debug("Examining {$entitlement->sku->title}");
 
             switch ($entitlement->sku->title) {
                 case "mailbox":
                     break;
 
                 case "storage":
                     $entry['mailquota'] += 1048576;
                     break;
 
                 default:
                     $roles[] = $entitlement->sku->title;
                     break;
             }
         }
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $entry['nsroledn'] = [];
 
         if (in_array("2fa", $roles)) {
             $entry['nsroledn'][] = "cn=2fa-user,{$hostedRootDN}";
         }
 
         if (in_array("activesync", $roles)) {
             $entry['nsroledn'][] = "cn=activesync-user,{$hostedRootDN}";
         }
 
         if (!in_array("groupware", $roles)) {
             $entry['nsroledn'][] = "cn=imap-user,{$hostedRootDN}";
         }
     }
 
     /**
      * Get LDAP configuration for specified access level
      */
     private static function getConfig(string $privilege)
     {
         $config = [
             'domain_base_dn' => \config('ldap.domain_base_dn'),
             'domain_filter' => \config('ldap.domain_filter'),
             'domain_name_attribute' => \config('ldap.domain_name_attribute'),
             'hosts' => \config('ldap.hosts'),
             'sort' => false,
             'vlv' => false,
             'log_hook' => 'App\Backends\LDAP::logHook',
         ];
 
         return $config;
     }
 
     /**
      * Get user entry from LDAP.
      *
      * @param \Net_LDAP3 $ldap  Ldap connection
      * @param string     $email User email (uid)
      * @param string     $dn    Reference to user DN
      * @param bool       $full  Get extra attributes, e.g. nsroledn
      *
      * @return false|null|array User entry, False on error, NULL if not found
      */
     private static function getUserEntry($ldap, $email, &$dn = null, $full = false)
     {
         list($_local, $_domain) = explode('@', $email, 2);
 
         $domain = $ldap->find_domain($_domain);
 
         if (!$domain) {
             return $domain;
         }
 
         $base_dn = $ldap->domain_root_dn($_domain);
         $dn = "uid={$email},ou=People,{$base_dn}";
 
         $entry = $ldap->get_entry($dn);
 
         if ($entry && $full) {
             if (!array_key_exists('nsroledn', $entry)) {
                 $roles = $ldap->get_entry_attributes($dn, ['nsroledn']);
                 if (!empty($roles)) {
                     $entry['nsroledn'] = (array) $roles['nsroledn'];
                 }
             }
         }
 
         return $entry ?: null;
     }
 
     /**
      * Logging callback
      */
     public static function logHook($level, $msg): void
     {
         if (
             (
                 $level == LOG_INFO
                 || $level == LOG_DEBUG
                 || $level == LOG_NOTICE
             )
             && !\config('app.debug')
         ) {
             return;
         }
 
         switch ($level) {
             case LOG_CRIT:
                 $function = 'critical';
                 break;
             case LOG_EMERG:
                 $function = 'emergency';
                 break;
             case LOG_ERR:
                 $function = 'error';
                 break;
             case LOG_ALERT:
                 $function = 'alert';
                 break;
             case LOG_WARNING:
                 $function = 'warning';
                 break;
             case LOG_INFO:
                 $function = 'info';
                 break;
             case LOG_DEBUG:
                 $function = 'debug';
                 break;
             case LOG_NOTICE:
                 $function = 'notice';
                 break;
             default:
                 $function = 'info';
         }
 
         if (is_array($msg)) {
             $msg = implode("\n", $msg);
         }
 
         $msg = '[LDAP] ' . $msg;
 
         \Log::{$function}($msg);
     }
 
     /**
      * Throw exception and close the connection when needed
      *
      * @param \Net_LDAP3 $ldap    Ldap connection
      * @param string     $message Exception message
      *
      * @throws \Exception
      */
     private static function throwException($ldap, string $message): void
     {
         if (empty(self::$ldap) && !empty($ldap)) {
             $ldap->close();
         }
 
         throw new \Exception($message);
     }
 }
diff --git a/src/app/Domain.php b/src/app/Domain.php
index ed292a0c..667eaa55 100644
--- a/src/app/Domain.php
+++ b/src/app/Domain.php
@@ -1,406 +1,445 @@
 <?php
 
 namespace App;
 
 use App\Wallet;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 /**
  * The eloquent definition of a Domain.
  *
  * @property string $namespace
  */
 class Domain extends Model
 {
     use SoftDeletes;
 
     // we've simply never heard of this domain
     public const STATUS_NEW        = 1 << 0;
     // it's been activated
     public const STATUS_ACTIVE     = 1 << 1;
     // domain has been suspended.
     public const STATUS_SUSPENDED  = 1 << 2;
     // domain has been deleted
     public const STATUS_DELETED    = 1 << 3;
     // ownership of the domain has been confirmed
     public const STATUS_CONFIRMED  = 1 << 4;
     // domain has been verified that it exists in DNS
     public const STATUS_VERIFIED   = 1 << 5;
     // domain has been created in LDAP
     public const STATUS_LDAP_READY = 1 << 6;
 
     // open for public registration
     public const TYPE_PUBLIC       = 1 << 0;
     // zone hosted with us
     public const TYPE_HOSTED       = 1 << 1;
     // zone registered externally
     public const TYPE_EXTERNAL     = 1 << 2;
 
     public const HASH_CODE = 1;
     public const HASH_TEXT = 2;
     public const HASH_CNAME = 3;
 
     public $incrementing = false;
 
     protected $keyType = 'bigint';
 
     protected $fillable = [
         'namespace',
         'status',
         'type'
     ];
 
     /**
      * Assign a package to a domain. The domain should not belong to any existing entitlements.
      *
      * @param \App\Package $package The package to assign.
      * @param \App\User    $user    The wallet owner.
      *
      * @return \App\Domain Self
      */
     public function assignPackage($package, $user)
     {
         // If this domain is public it can not be assigned to a user.
         if ($this->isPublic()) {
             return $this;
         }
 
         // See if this domain is already owned by another user.
         $wallet = $this->wallet();
 
         if ($wallet) {
             \Log::error(
                 "Domain {$this->namespace} is already assigned to {$wallet->owner->email}"
             );
 
             return $this;
         }
 
         $wallet_id = $user->wallets()->first()->id;
 
         foreach ($package->skus as $sku) {
             for ($i = $sku->pivot->qty; $i > 0; $i--) {
                 \App\Entitlement::create(
                     [
                         'wallet_id' => $wallet_id,
                         'sku_id' => $sku->id,
                         'cost' => $sku->pivot->cost(),
                         'entitleable_id' => $this->id,
                         'entitleable_type' => Domain::class
                     ]
                 );
             }
         }
 
         return $this;
     }
 
     public function entitlement()
     {
         return $this->morphOne('App\Entitlement', 'entitleable');
     }
 
     /**
      * Return list of public+active domain names
      */
     public static function getPublicDomains(): array
     {
         $where = sprintf('(type & %s)', Domain::TYPE_PUBLIC);
 
         return self::whereRaw($where)->get(['namespace'])->pluck('namespace')->toArray();
     }
 
     /**
      * Returns whether this domain is active.
      *
      * @return bool
      */
     public function isActive(): bool
     {
         return ($this->status & self::STATUS_ACTIVE) > 0;
     }
 
     /**
      * Returns whether this domain is confirmed the ownership of.
      *
      * @return bool
      */
     public function isConfirmed(): bool
     {
         return ($this->status & self::STATUS_CONFIRMED) > 0;
     }
 
     /**
      * Returns whether this domain is deleted.
      *
      * @return bool
      */
     public function isDeleted(): bool
     {
         return ($this->status & self::STATUS_DELETED) > 0;
     }
 
     /**
      * Returns whether this domain is registered with us.
      *
      * @return bool
      */
     public function isExternal(): bool
     {
         return ($this->type & self::TYPE_EXTERNAL) > 0;
     }
 
     /**
      * Returns whether this domain is hosted with us.
      *
      * @return bool
      */
     public function isHosted(): bool
     {
         return ($this->type & self::TYPE_HOSTED) > 0;
     }
 
     /**
      * Returns whether this domain is new.
      *
      * @return bool
      */
     public function isNew(): bool
     {
         return ($this->status & self::STATUS_NEW) > 0;
     }
 
     /**
      * Returns whether this domain is public.
      *
      * @return bool
      */
     public function isPublic(): bool
     {
         return ($this->type & self::TYPE_PUBLIC) > 0;
     }
 
     /**
      * Returns whether this domain is registered in LDAP.
      *
      * @return bool
      */
     public function isLdapReady(): bool
     {
         return ($this->status & self::STATUS_LDAP_READY) > 0;
     }
 
     /**
      * Returns whether this domain is suspended.
      *
      * @return bool
      */
     public function isSuspended(): bool
     {
         return ($this->status & self::STATUS_SUSPENDED) > 0;
     }
 
     /**
      * Returns whether this (external) domain has been verified
      * to exist in DNS.
      *
      * @return bool
      */
     public function isVerified(): bool
     {
         return ($this->status & self::STATUS_VERIFIED) > 0;
     }
 
     /**
      * Ensure the namespace is appropriately cased.
      */
     public function setNamespaceAttribute($namespace)
     {
         $this->attributes['namespace'] = strtolower($namespace);
     }
 
     /**
      * Domain status mutator
      *
      * @throws \Exception
      */
     public function setStatusAttribute($status)
     {
         $new_status = 0;
 
         $allowed_values = [
             self::STATUS_NEW,
             self::STATUS_ACTIVE,
-            self::STATUS_CONFIRMED,
             self::STATUS_SUSPENDED,
             self::STATUS_DELETED,
-            self::STATUS_LDAP_READY,
+            self::STATUS_CONFIRMED,
             self::STATUS_VERIFIED,
+            self::STATUS_LDAP_READY,
         ];
 
         foreach ($allowed_values as $value) {
             if ($status & $value) {
                 $new_status |= $value;
                 $status ^= $value;
             }
         }
 
         if ($status > 0) {
             throw new \Exception("Invalid domain status: {$status}");
         }
 
+        if ($this->isPublic()) {
+            $this->attributes['status'] = $new_status;
+            return;
+        }
+
+        if ($new_status & self::STATUS_CONFIRMED) {
+            // if we have confirmed ownership of or management access to the domain, then we have
+            // also confirmed the domain exists in DNS.
+            $new_status |= self::STATUS_VERIFIED;
+            $new_status |= self::STATUS_ACTIVE;
+        }
+
+        if ($new_status & self::STATUS_DELETED && $new_status & self::STATUS_ACTIVE) {
+            $new_status ^= self::STATUS_ACTIVE;
+        }
+
+        if ($new_status & self::STATUS_SUSPENDED && $new_status & self::STATUS_ACTIVE) {
+            $new_status ^= self::STATUS_ACTIVE;
+        }
+
+        // if the domain is now active, it is not new anymore.
+        if ($new_status & self::STATUS_ACTIVE && $new_status & self::STATUS_NEW) {
+            $new_status ^= self::STATUS_NEW;
+        }
+
         $this->attributes['status'] = $new_status;
     }
 
     /**
      * Ownership verification by checking for a TXT (or CNAME) record
      * in the domain's DNS (that matches the verification hash).
      *
      * @return bool True if verification was successful, false otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function confirm(): bool
     {
         if ($this->isConfirmed()) {
             return true;
         }
 
         $hash = $this->hash(self::HASH_TEXT);
         $confirmed = false;
 
         // Get DNS records and find a matching TXT entry
         $records = \dns_get_record($this->namespace, DNS_TXT);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         foreach ($records as $record) {
             if ($record['txt'] === $hash) {
                 $confirmed = true;
                 break;
             }
         }
 
         // Get DNS records and find a matching CNAME entry
         // Note: some servers resolve every non-existing name
         // so we need to define left and right side of the CNAME record
         // i.e.: kolab-verify IN CNAME <hash>.domain.tld.
         if (!$confirmed) {
             $cname = $this->hash(self::HASH_CODE) . '.' . $this->namespace;
             $records = \dns_get_record('kolab-verify.' . $this->namespace, DNS_CNAME);
 
             if ($records === false) {
                 throw new \Exception("Failed to get DNS record for {$this->namespace}");
             }
 
             foreach ($records as $records) {
                 if ($records['target'] === $cname) {
                     $confirmed = true;
                     break;
                 }
             }
         }
 
         if ($confirmed) {
             $this->status |= Domain::STATUS_CONFIRMED;
             $this->save();
         }
 
         return $confirmed;
     }
 
     /**
      * Generate a verification hash for this domain
      *
      * @param int $mod One of: HASH_CNAME, HASH_CODE (Default), HASH_TEXT
      *
      * @return string Verification hash
      */
     public function hash($mod = null): string
     {
         $cname = 'kolab-verify';
 
         if ($mod === self::HASH_CNAME) {
             return $cname;
         }
 
         $hash = \md5('hkccp-verify-' . $this->namespace);
 
         return $mod === self::HASH_TEXT ? "$cname=$hash" : $hash;
     }
 
     /**
      * Suspend this domain.
      *
      * @return void
      */
     public function suspend(): void
     {
         if ($this->isSuspended()) {
             return;
         }
 
         $this->status |= Domain::STATUS_SUSPENDED;
         $this->save();
     }
 
     /**
      * Unsuspend this domain.
      *
+     * The domain is unsuspended through either of the following courses of actions;
+     *
+     *   * The account balance has been topped up, or
+     *   * a suspected spammer has resolved their issues, or
+     *   * the command-line is triggered.
+     *
+     * Therefore, we can also confidently set the domain status to 'active' should the ownership of or management
+     * access to have been confirmed before.
+     *
      * @return void
      */
     public function unsuspend(): void
     {
         if (!$this->isSuspended()) {
             return;
         }
 
         $this->status ^= Domain::STATUS_SUSPENDED;
+
+        if ($this->isConfirmed() && $this->isVerified()) {
+            $this->status |= Domain::STATUS_ACTIVE;
+        }
+
         $this->save();
     }
 
     /**
      * Verify if a domain exists in DNS
      *
      * @return bool True if registered, False otherwise
      * @throws \Exception Throws exception on DNS or DB errors
      */
     public function verify(): bool
     {
         if ($this->isVerified()) {
             return true;
         }
 
         $records = \dns_get_record($this->namespace, DNS_ANY);
 
         if ($records === false) {
             throw new \Exception("Failed to get DNS record for {$this->namespace}");
         }
 
         // It may happen that result contains other domains depending on the host DNS setup
         // that's why in_array() and not just !empty()
         if (in_array($this->namespace, array_column($records, 'host'))) {
             $this->status |= Domain::STATUS_VERIFIED;
             $this->save();
 
             return true;
         }
 
         return false;
     }
 
     /**
      * Returns the wallet by which the domain is controlled
      *
      * @return \App\Wallet A wallet object
      */
     public function wallet(): ?Wallet
     {
         // Note: Not all domains have a entitlement/wallet
         $entitlement = $this->entitlement()->withTrashed()->first();
 
         return $entitlement ? $entitlement->wallet : null;
     }
 }
diff --git a/src/app/Observers/DomainObserver.php b/src/app/Observers/DomainObserver.php
index 344e2143..72be1d66 100644
--- a/src/app/Observers/DomainObserver.php
+++ b/src/app/Observers/DomainObserver.php
@@ -1,109 +1,109 @@
 <?php
 
 namespace App\Observers;
 
 use App\Domain;
 use Illuminate\Support\Facades\DB;
 
 class DomainObserver
 {
     /**
      * Handle the domain "created" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function creating(Domain $domain): void
     {
         while (true) {
             $allegedly_unique = \App\Utils::uuidInt();
             if (!Domain::find($allegedly_unique)) {
                 $domain->{$domain->getKeyName()} = $allegedly_unique;
                 break;
             }
         }
 
         $domain->namespace = \strtolower($domain->namespace);
 
-        $domain->status |= Domain::STATUS_NEW | Domain::STATUS_ACTIVE;
+        $domain->status |= Domain::STATUS_NEW;
     }
 
     /**
      * Handle the domain "created" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function created(Domain $domain)
     {
         // Create domain record in LDAP
         // Note: DomainCreate job will dispatch DomainVerify job
         \App\Jobs\Domain\CreateJob::dispatch($domain->id);
     }
 
     /**
      * Handle the domain "deleting" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function deleting(Domain $domain)
     {
         // Entitlements do not have referential integrity on the entitled object, so this is our
         // way of doing an onDelete('cascade') without the foreign key.
         \App\Entitlement::where('entitleable_id', $domain->id)
             ->where('entitleable_type', Domain::class)
             ->delete();
     }
 
     /**
      * Handle the domain "deleted" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function deleted(Domain $domain)
     {
         \App\Jobs\Domain\DeleteJob::dispatch($domain->id);
     }
 
     /**
      * Handle the domain "updated" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function updated(Domain $domain)
     {
         \App\Jobs\Domain\UpdateJob::dispatch($domain->id);
     }
 
     /**
      * Handle the domain "restored" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function restored(Domain $domain)
     {
         //
     }
 
     /**
      * Handle the domain "force deleted" event.
      *
      * @param \App\Domain $domain The domain.
      *
      * @return void
      */
     public function forceDeleted(Domain $domain)
     {
         //
     }
 }
diff --git a/src/phpunit.xml b/src/phpunit.xml
index e15b0c97..e3d49429 100644
--- a/src/phpunit.xml
+++ b/src/phpunit.xml
@@ -1,40 +1,44 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <phpunit backupGlobals="false"
          backupStaticAttributes="false"
          bootstrap="vendor/autoload.php"
          colors="true"
          convertErrorsToExceptions="true"
          convertNoticesToExceptions="true"
          convertWarningsToExceptions="true"
          processIsolation="false"
          stopOnFailure="false">
     <testsuites>
         <testsuite name="Unit">
             <directory suffix="Test.php">tests/Unit</directory>
         </testsuite>
 
+        <testsuite name="Functional">
+            <directory suffix="Test.php">tests/Functional</directory>
+        </testsuite>
+
         <testsuite name="Feature">
             <directory suffix="Test.php">tests/Feature</directory>
         </testsuite>
 
         <testsuite name="Browser">
             <directory suffix="Test.php">tests/Browser</directory>
         </testsuite>
     </testsuites>
     <filter>
         <whitelist processUncoveredFilesFromWhitelist="true">
             <directory suffix=".php">./app</directory>
         </whitelist>
     </filter>
     <logging>
         <log type="coverage-html" target="./tests/report/" lowUpperBound="35" highLowerBound="70"/>
     </logging>
     <php>
         <server name="APP_ENV" value="testing"/>
         <server name="APP_DEBUG" value="true"/>
         <server name="BCRYPT_ROUNDS" value="4"/>
         <server name="MAIL_DRIVER" value="array"/>
         <server name="QUEUE_CONNECTION" value="sync"/>
         <server name="SESSION_DRIVER" value="array"/>
     </php>
 </phpunit>
diff --git a/src/tests/Browser/StatusTest.php b/src/tests/Browser/StatusTest.php
index 0a312d6c..781e2e76 100644
--- a/src/tests/Browser/StatusTest.php
+++ b/src/tests/Browser/StatusTest.php
@@ -1,270 +1,289 @@
 <?php
 
 namespace Tests\Browser;
 
 use App\Domain;
 use App\User;
 use Carbon\Carbon;
 use Tests\Browser;
 use Tests\Browser\Components\Status;
 use Tests\Browser\Components\Toast;
 use Tests\Browser\Pages\Dashboard;
 use Tests\Browser\Pages\DomainInfo;
 use Tests\Browser\Pages\DomainList;
 use Tests\Browser\Pages\Home;
 use Tests\Browser\Pages\UserInfo;
 use Tests\Browser\Pages\UserList;
 use Tests\TestCaseDusk;
 use Illuminate\Support\Facades\DB;
 
 class StatusTest extends TestCaseDusk
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $domain_status = Domain::STATUS_CONFIRMED | Domain::STATUS_VERIFIED;
         DB::statement("UPDATE domains SET status = (status | {$domain_status})"
             . " WHERE namespace = 'kolab.org'");
         DB::statement("UPDATE users SET status = (status | " . User::STATUS_IMAP_READY . ")"
             . " WHERE email = 'john@kolab.org'");
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $domain_status = Domain::STATUS_CONFIRMED | Domain::STATUS_VERIFIED;
         DB::statement("UPDATE domains SET status = (status | {$domain_status})"
             . " WHERE namespace = 'kolab.org'");
         DB::statement("UPDATE users SET status = (status | " . User::STATUS_IMAP_READY . ")"
             . " WHERE email = 'john@kolab.org'");
 
         parent::tearDown();
     }
 
     /**
      * Test account status in the Dashboard
      */
     public function testDashboard(): void
     {
         // Unconfirmed domain and user
         $domain = Domain::where('namespace', 'kolab.org')->first();
+
         if ($domain->isConfirmed()) {
             $domain->status ^= Domain::STATUS_CONFIRMED;
             $domain->save();
         }
 
         $john = $this->getTestUser('john@kolab.org');
+
         $john->created_at = Carbon::now();
+
         if ($john->isImapReady()) {
             $john->status ^= User::STATUS_IMAP_READY;
         }
+
         $john->save();
 
         $this->browse(function ($browser) use ($john, $domain) {
             $browser->visit(new Home())
                 ->submitLogon('john@kolab.org', 'simple123', true)
                 ->on(new Dashboard())
                 ->with(new Status(), function ($browser) use ($john) {
                     $browser->assertSeeIn('@body', 'We are preparing your account')
                         ->assertProgress(71, 'Creating a mailbox...', 'pending')
                         ->assertMissing('#status-verify')
                         ->assertMissing('#status-link')
                         ->assertMissing('@refresh-button')
                         ->assertMissing('@refresh-text');
 
                     $john->status |= User::STATUS_IMAP_READY;
                     $john->save();
 
                     // Wait for auto-refresh, expect domain-confirmed step
                     $browser->pause(6000)
                         ->assertSeeIn('@body', 'Your account is almost ready')
                         ->assertProgress(85, 'Verifying an ownership of a custom domain...', 'failed')
                         ->assertMissing('@refresh-button')
                         ->assertMissing('@refresh-text')
                         ->assertMissing('#status-verify')
                         ->assertVisible('#status-link');
                 })
                 // check if the link to domain info page works
                 ->click('#status-link')
                 ->on(new DomainInfo())
                 ->back()
                 ->on(new Dashboard())
                 ->with(new Status(), function ($browser) {
                     $browser->assertMissing('@refresh-button')
                         ->assertProgress(85, 'Verifying an ownership of a custom domain...', 'failed');
                 });
 
             // Confirm the domain and wait until the whole status box disappears
             $domain->status |= Domain::STATUS_CONFIRMED;
             $domain->save();
 
             // This should take less than 10 seconds
             $browser->waitUntilMissing('@status', 10);
         });
 
         // Test  the Refresh button
         if ($domain->isConfirmed()) {
             $domain->status ^= Domain::STATUS_CONFIRMED;
             $domain->save();
         }
+
         $john->created_at = Carbon::now()->subSeconds(3600);
+
         if ($john->isImapReady()) {
             $john->status ^= User::STATUS_IMAP_READY;
         }
+
         $john->save();
 
         $this->browse(function ($browser) use ($john, $domain) {
             $browser->visit(new Dashboard())
                 ->with(new Status(), function ($browser) use ($john, $domain) {
                     $browser->assertSeeIn('@body', 'We are preparing your account')
                         ->assertProgress(71, 'Creating a mailbox...', 'failed')
                         ->assertVisible('@refresh-button')
                         ->assertVisible('@refresh-text');
 
                     if ($john->refresh()->isImapReady()) {
                         $john->status ^= User::STATUS_IMAP_READY;
                         $john->save();
                     }
                     $domain->status |= Domain::STATUS_CONFIRMED;
                     $domain->save();
 
                     $browser->click('@refresh-button')
                         ->assertToast(Toast::TYPE_SUCCESS, 'Setup process finished successfully.');
                 })
                 ->assertMissing('@status');
         });
     }
 
     /**
      * Test domain status on domains list and domain info page
      *
      * @depends testDashboard
      */
     public function testDomainStatus(): void
     {
         $domain = Domain::where('namespace', 'kolab.org')->first();
         $domain->created_at = Carbon::now();
         $domain->status = Domain::STATUS_NEW | Domain::STATUS_ACTIVE | Domain::STATUS_LDAP_READY;
         $domain->save();
 
+        // side-step
+        $this->assertFalse($domain->isNew());
+        $this->assertTrue($domain->isActive());
+        $this->assertTrue($domain->isLdapReady());
+        $this->assertTrue($domain->isExternal());
+
+        $this->assertFalse($domain->isHosted());
+        $this->assertFalse($domain->isConfirmed());
+        $this->assertFalse($domain->isVerified());
+        $this->assertFalse($domain->isSuspended());
+        $this->assertFalse($domain->isDeleted());
+
         $this->browse(function ($browser) use ($domain) {
             // Test auto-refresh
             $browser->on(new Dashboard())
                 ->click('@links a.link-domains')
                 ->on(new DomainList())
                 ->waitFor('@table tbody tr')
                 // Assert domain status icon
                 ->assertVisible('@table tbody tr:first-child td:first-child svg.fa-globe.text-danger')
                 ->assertText('@table tbody tr:first-child td:first-child svg title', 'Not Ready')
                 ->click('@table tbody tr:first-child td:first-child a')
                 ->on(new DomainInfo())
                 ->with(new Status(), function ($browser) {
                     $browser->assertSeeIn('@body', 'We are preparing the domain')
                         ->assertProgress(50, 'Verifying a custom domain...', 'pending')
                         ->assertMissing('@refresh-button')
                         ->assertMissing('@refresh-text')
                         ->assertMissing('#status-link')
                         ->assertMissing('#status-verify');
                 });
 
             $domain->status |= Domain::STATUS_VERIFIED;
             $domain->save();
 
             // This should take less than 10 seconds
             $browser->waitFor('@status.process-failed')
                 ->with(new Status(), function ($browser) {
                     $browser->assertSeeIn('@body', 'The domain is almost ready')
                         ->assertProgress(75, 'Verifying an ownership of a custom domain...', 'failed')
                         ->assertMissing('@refresh-button')
                         ->assertMissing('@refresh-text')
                         ->assertMissing('#status-link')
                         ->assertVisible('#status-verify');
                 });
 
             $domain->status |= Domain::STATUS_CONFIRMED;
             $domain->save();
 
             // Test Verify button
             $browser->click('@status #status-verify')
                 ->assertToast(Toast::TYPE_SUCCESS, 'Domain verified successfully.')
                 ->waitUntilMissing('@status')
                 ->assertMissing('@verify')
                 ->assertVisible('@config');
         });
     }
 
     /**
      * Test user status on users list and user info page
      *
      * @depends testDashboard
      */
     public function testUserStatus(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $john->created_at = Carbon::now();
         if ($john->isImapReady()) {
             $john->status ^= User::STATUS_IMAP_READY;
         }
         $john->save();
 
         $domain = Domain::where('namespace', 'kolab.org')->first();
         if ($domain->isConfirmed()) {
             $domain->status ^= Domain::STATUS_CONFIRMED;
             $domain->save();
         }
 
         $this->browse(function ($browser) use ($john, $domain) {
             $browser->visit(new Dashboard())
                 ->click('@links a.link-users')
                 ->on(new UserList())
                 ->waitFor('@table tbody tr')
                 // Assert user status icons
                 ->assertVisible('@table tbody tr:first-child td:first-child svg.fa-user.text-success')
                 ->assertText('@table tbody tr:first-child td:first-child svg title', 'Active')
                 ->assertVisible('@table tbody tr:nth-child(3) td:first-child svg.fa-user.text-danger')
                 ->assertText('@table tbody tr:nth-child(3) td:first-child svg title', 'Not Ready')
                 ->click('@table tbody tr:nth-child(3) td:first-child a')
                 ->on(new UserInfo())
                 ->with('@form', function (Browser $browser) {
                     // Assert state in the user edit form
                     $browser->assertSeeIn('div.row:nth-child(1) label', 'Status')
                         ->assertSeeIn('div.row:nth-child(1) #status', 'Not Ready');
                 })
                 ->with(new Status(), function ($browser) use ($john) {
                     $browser->assertSeeIn('@body', 'We are preparing the user account')
                         ->assertProgress(71, 'Creating a mailbox...', 'pending')
                         ->assertMissing('#status-verify')
                         ->assertMissing('#status-link')
                         ->assertMissing('@refresh-button')
                         ->assertMissing('@refresh-text');
 
 
                     $john->status |= User::STATUS_IMAP_READY;
                     $john->save();
 
                     // Wait for auto-refresh, expect domain-confirmed step
                     $browser->pause(6000)
                         ->assertSeeIn('@body', 'The user account is almost ready')
                         ->assertProgress(85, 'Verifying an ownership of a custom domain...', 'failed')
                         ->assertMissing('@refresh-button')
                         ->assertMissing('@refresh-text')
                         ->assertMissing('#status-verify')
                         ->assertVisible('#status-link');
                 })
                 ->assertSeeIn('#status', 'Active');
 
             // Confirm the domain and wait until the whole status box disappears
             $domain->status |= Domain::STATUS_CONFIRMED;
             $domain->save();
 
             // This should take less than 10 seconds
             $browser->waitUntilMissing('@status', 10);
         });
     }
 }
diff --git a/src/tests/Feature/Controller/DomainsTest.php b/src/tests/Feature/Controller/DomainsTest.php
index cf2f1a31..69fd44ba 100644
--- a/src/tests/Feature/Controller/DomainsTest.php
+++ b/src/tests/Feature/Controller/DomainsTest.php
@@ -1,243 +1,243 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\DomainsController;
 use App\Domain;
 use App\Entitlement;
 use App\Sku;
 use App\User;
 use App\Wallet;
 use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class DomainsTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('test1@domainscontroller.com');
         $this->deleteTestDomain('domainscontroller.com');
     }
 
     public function tearDown(): void
     {
         $this->deleteTestUser('test1@domainscontroller.com');
         $this->deleteTestDomain('domainscontroller.com');
 
         parent::tearDown();
     }
 
     /**
      * Test domain confirm request
      */
     public function testConfirm(): void
     {
         $sku_domain = Sku::where('title', 'domain-hosting')->first();
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $user = $this->getTestUser('test1@domainscontroller.com');
         $domain = $this->getTestDomain('domainscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         Entitlement::create([
                 'wallet_id' => $user->wallets()->first()->id,
                 'sku_id' => $sku_domain->id,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class
         ]);
 
         $response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}/confirm");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(2, $json);
         $this->assertEquals('error', $json['status']);
         $this->assertEquals('Domain ownership verification failed.', $json['message']);
 
         $domain->status |= Domain::STATUS_CONFIRMED;
         $domain->save();
 
         $response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}/confirm");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals('success', $json['status']);
         $this->assertEquals('Domain verified successfully.', $json['message']);
         $this->assertTrue(is_array($json['statusInfo']));
 
         // Not authorized access
         $response = $this->actingAs($john)->get("api/v4/domains/{$domain->id}/confirm");
         $response->assertStatus(403);
 
         // Authorized access by additional account controller
         $domain = $this->getTestDomain('kolab.org');
         $response = $this->actingAs($ned)->get("api/v4/domains/{$domain->id}/confirm");
         $response->assertStatus(200);
     }
 
     /**
      * Test fetching domains list
      */
     public function testIndex(): void
     {
         // User with no domains
         $user = $this->getTestUser('test1@domainscontroller.com');
         $response = $this->actingAs($user)->get("api/v4/domains");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame([], $json);
 
         // User with custom domain(s)
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
 
         $response = $this->actingAs($john)->get("api/v4/domains");
         $response->assertStatus(200);
 
         $json = $response->json();
         $this->assertCount(1, $json);
         $this->assertSame('kolab.org', $json[0]['namespace']);
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isConfirmed', $json[0]);
         $this->assertArrayHasKey('isDeleted', $json[0]);
         $this->assertArrayHasKey('isVerified', $json[0]);
         $this->assertArrayHasKey('isSuspended', $json[0]);
         $this->assertArrayHasKey('isActive', $json[0]);
         $this->assertArrayHasKey('isLdapReady', $json[0]);
 
         $response = $this->actingAs($ned)->get("api/v4/domains");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(1, $json);
         $this->assertSame('kolab.org', $json[0]['namespace']);
     }
 
     /**
      * Test fetching domain info
      */
     public function testShow(): void
     {
         $sku_domain = Sku::where('title', 'domain-hosting')->first();
         $user = $this->getTestUser('test1@domainscontroller.com');
         $domain = $this->getTestDomain('domainscontroller.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         Entitlement::create([
                 'wallet_id' => $user->wallets()->first()->id,
                 'sku_id' => $sku_domain->id,
                 'entitleable_id' => $domain->id,
                 'entitleable_type' => Domain::class
         ]);
 
         $response = $this->actingAs($user)->get("api/v4/domains/{$domain->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals($domain->id, $json['id']);
         $this->assertEquals($domain->namespace, $json['namespace']);
         $this->assertEquals($domain->status, $json['status']);
         $this->assertEquals($domain->type, $json['type']);
         $this->assertSame($domain->hash(Domain::HASH_TEXT), $json['hash_text']);
         $this->assertSame($domain->hash(Domain::HASH_CNAME), $json['hash_cname']);
         $this->assertSame($domain->hash(Domain::HASH_CODE), $json['hash_code']);
         $this->assertCount(4, $json['config']);
         $this->assertTrue(strpos(implode("\n", $json['config']), $domain->namespace) !== false);
         $this->assertCount(8, $json['dns']);
         $this->assertTrue(strpos(implode("\n", $json['dns']), $domain->namespace) !== false);
         $this->assertTrue(strpos(implode("\n", $json['dns']), $domain->hash()) !== false);
         $this->assertTrue(is_array($json['statusInfo']));
         // Values below are tested by Unit tests
         $this->assertArrayHasKey('isConfirmed', $json);
         $this->assertArrayHasKey('isDeleted', $json);
         $this->assertArrayHasKey('isVerified', $json);
         $this->assertArrayHasKey('isSuspended', $json);
         $this->assertArrayHasKey('isActive', $json);
         $this->assertArrayHasKey('isLdapReady', $json);
 
         $john = $this->getTestUser('john@kolab.org');
         $ned = $this->getTestUser('ned@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
 
         // Not authorized - Other account domain
         $response = $this->actingAs($john)->get("api/v4/domains/{$domain->id}");
         $response->assertStatus(403);
 
         $domain = $this->getTestDomain('kolab.org');
 
         // Ned is an additional controller on kolab.org's wallet
         $response = $this->actingAs($ned)->get("api/v4/domains/{$domain->id}");
         $response->assertStatus(200);
 
         // Jack has no entitlement/control over kolab.org
         $response = $this->actingAs($jack)->get("api/v4/domains/{$domain->id}");
         $response->assertStatus(403);
     }
 
     /**
      * Test fetching domain status (GET /api/v4/domains/<domain-id>/status)
      * and forcing setup process update (?refresh=1)
      *
      * @group dns
      */
     public function testStatus(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $domain = $this->getTestDomain('kolab.org');
 
         // Test unauthorized access
         $response = $this->actingAs($jack)->get("/api/v4/domains/{$domain->id}/status");
         $response->assertStatus(403);
 
         $domain->status = Domain::STATUS_NEW | Domain::STATUS_ACTIVE | Domain::STATUS_LDAP_READY;
         $domain->save();
 
         // Get domain status
         $response = $this->actingAs($john)->get("/api/v4/domains/{$domain->id}/status");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertFalse($json['isVerified']);
         $this->assertFalse($json['isReady']);
         $this->assertCount(4, $json['process']);
         $this->assertSame('domain-verified', $json['process'][2]['label']);
         $this->assertSame(false, $json['process'][2]['state']);
         $this->assertTrue(empty($json['status']));
         $this->assertTrue(empty($json['message']));
 
         // Now "reboot" the process and verify the domain
         $response = $this->actingAs($john)->get("/api/v4/domains/{$domain->id}/status?refresh=1");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertTrue($json['isVerified']);
-        $this->assertFalse($json['isReady']);
+        $this->assertTrue($json['isReady']);
         $this->assertCount(4, $json['process']);
         $this->assertSame('domain-verified', $json['process'][2]['label']);
         $this->assertSame(true, $json['process'][2]['state']);
         $this->assertSame('domain-confirmed', $json['process'][3]['label']);
-        $this->assertSame(false, $json['process'][3]['state']);
-        $this->assertSame('error', $json['status']);
-        $this->assertSame('Failed to verify an ownership of a domain.', $json['message']);
+        $this->assertSame(true, $json['process'][3]['state']);
+        $this->assertSame('success', $json['status']);
+        $this->assertSame('Setup process finished successfully.', $json['message']);
 
         // TODO: Test completing all process steps
     }
 }
diff --git a/src/tests/Feature/Controller/PaymentsStripeTest.php b/src/tests/Feature/Controller/PaymentsStripeTest.php
index b18daefb..ea772d6b 100644
--- a/src/tests/Feature/Controller/PaymentsStripeTest.php
+++ b/src/tests/Feature/Controller/PaymentsStripeTest.php
@@ -1,676 +1,677 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\V4\PaymentsController;
 use App\Payment;
 use App\Providers\PaymentProvider;
 use App\Transaction;
 use App\Wallet;
 use App\WalletSetting;
 use GuzzleHttp\Psr7\Response;
 use Illuminate\Support\Facades\Bus;
 use Tests\TestCase;
 use Tests\StripeMocksTrait;
 
 class PaymentsStripeTest extends TestCase
 {
     use StripeMocksTrait;
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         // All tests in this file use Stripe
         \config(['services.payment_provider' => 'stripe']);
 
         $john = $this->getTestUser('john@kolab.org');
         $wallet = $john->wallets()->first();
         Payment::where('wallet_id', $wallet->id)->delete();
         Wallet::where('id', $wallet->id)->update(['balance' => 0]);
         WalletSetting::where('wallet_id', $wallet->id)->delete();
         Transaction::where('object_id', $wallet->id)
             ->where('type', Transaction::WALLET_CREDIT)->delete();
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $wallet = $john->wallets()->first();
         Payment::where('wallet_id', $wallet->id)->delete();
         Wallet::where('id', $wallet->id)->update(['balance' => 0]);
         WalletSetting::where('wallet_id', $wallet->id)->delete();
         Transaction::where('object_id', $wallet->id)
             ->where('type', Transaction::WALLET_CREDIT)->delete();
 
         parent::tearDown();
     }
 
     /**
      * Test creating/updating/deleting an outo-payment mandate
      *
      * @group stripe
      */
     public function testMandates(): void
     {
         Bus::fake();
 
         // Unauth access not allowed
         $response = $this->get("api/v4/payments/mandate");
         $response->assertStatus(401);
         $response = $this->post("api/v4/payments/mandate", []);
         $response->assertStatus(401);
         $response = $this->put("api/v4/payments/mandate", []);
         $response->assertStatus(401);
         $response = $this->delete("api/v4/payments/mandate");
         $response->assertStatus(401);
 
         $user = $this->getTestUser('john@kolab.org');
 
         // Test creating a mandate (invalid input)
         $post = [];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertSame('The amount field is required.', $json['errors']['amount'][0]);
         $this->assertSame('The balance field is required.', $json['errors']['balance'][0]);
 
         // Test creating a mandate (invalid input)
         $post = ['amount' => 100, 'balance' => 'a'];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame('The balance must be a number.', $json['errors']['balance'][0]);
 
         // Test creating a mandate (invalid input)
         $post = ['amount' => -100, 'balance' => 0];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $min = intval(PaymentProvider::MIN_AMOUNT / 100) . ' CHF';
         $this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);
 
         // Test creating a mandate (valid input)
         $post = ['amount' => 20.10, 'balance' => 0];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertRegExp('|^cs_test_|', $json['id']);
 
         // Test fetching the mandate information
         $response = $this->actingAs($user)->get("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals(20.10, $json['amount']);
         $this->assertEquals(0, $json['balance']);
         $this->assertSame(false, $json['isDisabled']);
 
         // We would have to invoke a browser to accept the "first payment" to make
         // the mandate validated/completed. Instead, we'll mock the mandate object.
         $setupIntent = '{
             "id": "AAA",
             "object": "setup_intent",
             "created": 123456789,
             "payment_method": "pm_YYY",
             "status": "succeeded",
             "usage": "off_session",
             "customer": null
         }';
 
         $paymentMethod = '{
             "id": "pm_YYY",
             "object": "payment_method",
             "card": {
                 "brand": "visa",
                 "country": "US",
                 "last4": "4242"
             },
             "created": 123456789,
             "type": "card"
         }';
 
         $client = $this->mockStripe();
         $client->addResponse($setupIntent);
         $client->addResponse($paymentMethod);
 
         // As we do not use checkout page, we do not receive a webworker request
         // I.e. we have to fake the mandate id
         $wallet = $user->wallets()->first();
         $wallet->setSetting('stripe_mandate_id', 'AAA');
         $wallet->setSetting('mandate_disabled', 1);
 
         $response = $this->actingAs($user)->get("api/v4/payments/mandate");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertEquals(20.10, $json['amount']);
         $this->assertEquals(0, $json['balance']);
         $this->assertEquals('Visa (**** **** **** 4242)', $json['method']);
         $this->assertSame(false, $json['isPending']);
         $this->assertSame(true, $json['isValid']);
         $this->assertSame(true, $json['isDisabled']);
 
         // Test updating mandate details (invalid input)
         $wallet->setSetting('mandate_disabled', null);
         $user->refresh();
         $post = [];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(2, $json['errors']);
         $this->assertSame('The amount field is required.', $json['errors']['amount'][0]);
         $this->assertSame('The balance field is required.', $json['errors']['balance'][0]);
 
         $post = ['amount' => -100, 'balance' => 0];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);
 
         // Test updating a mandate (valid input)
         $client->addResponse($setupIntent);
         $client->addResponse($paymentMethod);
 
         $post = ['amount' => 30.10, 'balance' => 1];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The auto-payment has been updated.', $json['message']);
         $this->assertEquals(30.10, $wallet->getSetting('mandate_amount'));
         $this->assertEquals(1, $wallet->getSetting('mandate_balance'));
         $this->assertSame('AAA', $json['id']);
         $this->assertFalse($json['isDisabled']);
 
         // Test updating a disabled mandate (invalid input)
         $wallet->setSetting('mandate_disabled', 1);
         $wallet->balance = -2000;
         $wallet->save();
         $user->refresh(); // required so the controller sees the wallet update from above
 
         $post = ['amount' => 15.10, 'balance' => 1];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $this->assertSame('The specified amount does not cover the balance on the account.', $json['errors']['amount']);
 
         // Test updating a disabled mandate (valid input)
         $client->addResponse($setupIntent);
         $client->addResponse($paymentMethod);
 
         $post = ['amount' => 30, 'balance' => 1];
         $response = $this->actingAs($user)->put("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertSame('The auto-payment has been updated.', $json['message']);
         $this->assertSame('AAA', $json['id']);
         $this->assertFalse($json['isDisabled']);
 
         Bus::assertDispatchedTimes(\App\Jobs\WalletCharge::class, 1);
         Bus::assertDispatched(\App\Jobs\WalletCharge::class, function ($job) use ($wallet) {
             $job_wallet = $this->getObjectProperty($job, 'wallet');
             return $job_wallet->id === $wallet->id;
         });
 
 
         $this->unmockStripe();
 
         // TODO: Delete mandate
     }
 
     /**
      * Test creating a payment and receiving a status via webhook
      *
      * @group stripe
      */
     public function testStoreAndWebhook(): void
     {
         Bus::fake();
 
         // Unauth access not allowed
         $response = $this->post("api/v4/payments", []);
         $response->assertStatus(401);
 
         $user = $this->getTestUser('john@kolab.org');
 
         $post = ['amount' => -1];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(422);
 
         $json = $response->json();
 
         $this->assertSame('error', $json['status']);
         $this->assertCount(1, $json['errors']);
         $min = intval(PaymentProvider::MIN_AMOUNT / 100) . ' CHF';
         $this->assertSame("Minimum amount for a single payment is {$min}.", $json['errors']['amount']);
 
         $post = ['amount' => '12.34'];
         $response = $this->actingAs($user)->post("api/v4/payments", $post);
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame('success', $json['status']);
         $this->assertRegExp('|^cs_test_|', $json['id']);
 
         $wallet = $user->wallets()->first();
         $payments = Payment::where('wallet_id', $wallet->id)->get();
 
         $this->assertCount(1, $payments);
         $payment = $payments[0];
         $this->assertSame(1234, $payment->amount);
         $this->assertSame(\config('app.name') . ' Payment', $payment->description);
         $this->assertSame('open', $payment->status);
         $this->assertEquals(0, $wallet->balance);
 
         // Test the webhook
 
         $post = [
             'id' => "evt_1GlZ814fj3SIEU8wtxMZ4Nsa",
             'object' => "event",
             'api_version' => "2020-03-02",
             'created' => 1590147209,
             'data' => [
                 'object' => [
                     'id' => $payment->id,
                     'object' => "payment_intent",
                     'amount' => 1234,
                     'amount_capturable' => 0,
                     'amount_received' => 1234,
                     'capture_method' => "automatic",
                     'client_secret' => "pi_1GlZ7w4fj3SIEU8w1RlBpN4l_secret_UYRNDTUUU7nkYHpOLZMb3uf48",
                     'confirmation_method' => "automatic",
                     'created' => 1590147204,
                     'currency' => "chf",
                     'customer' => "cus_HKDZ53OsKdlM83",
                     'last_payment_error' => null,
                     'livemode' => false,
                     'metadata' => [],
                     'receipt_email' => "payment-test@kolabnow.com",
                     'status' => "succeeded"
                 ]
             ],
             'type' => "payment_intent.succeeded"
         ];
 
         // Test payment succeeded event
         $response = $this->webhookRequest($post);
         $response->assertStatus(200);
 
         $this->assertSame(PaymentProvider::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         $transaction = $wallet->transactions()
             ->where('type', Transaction::WALLET_CREDIT)->get()->last();
 
         $this->assertSame(1234, $transaction->amount);
         $this->assertSame(
             "Payment transaction {$payment->id} using Stripe",
             $transaction->description
         );
 
         // Assert that email notification job wasn't dispatched,
         // it is expected only for recurring payments
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);
 
         // Test that balance didn't change if the same event is posted
         $response = $this->webhookRequest($post);
         $response->assertStatus(200);
 
         $this->assertSame(PaymentProvider::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         // Test for payment failure ('failed' status)
         $payment->refresh();
         $payment->status = PaymentProvider::STATUS_OPEN;
         $payment->save();
 
         $post['type'] = "payment_intent.payment_failed";
         $post['data']['object']['status'] = 'failed';
 
         $response = $this->webhookRequest($post);
         $response->assertStatus(200);
 
         $this->assertSame(PaymentProvider::STATUS_FAILED, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         // Assert that email notification job wasn't dispatched,
         // it is expected only for recurring payments
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);
 
         // Test for payment failure ('canceled' status)
         $payment->refresh();
         $payment->status = PaymentProvider::STATUS_OPEN;
         $payment->save();
 
         $post['type'] = "payment_intent.canceled";
         $post['data']['object']['status'] = 'canceled';
 
         $response = $this->webhookRequest($post);
         $response->assertStatus(200);
 
         $this->assertSame(PaymentProvider::STATUS_CANCELED, $payment->fresh()->status);
         $this->assertEquals(1234, $wallet->fresh()->balance);
 
         // Assert that email notification job wasn't dispatched,
         // it is expected only for recurring payments
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);
     }
 
     /**
      * Test receiving webhook request for setup intent
      *
      * @group stripe
      */
     public function testCreateMandateAndWebhook(): void
     {
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
 
         // Test creating a mandate (valid input)
         $post = ['amount' => 20.10, 'balance' => 0];
         $response = $this->actingAs($user)->post("api/v4/payments/mandate", $post);
         $response->assertStatus(200);
 
         $payment = $wallet->payments()->first();
 
         $this->assertSame(PaymentProvider::STATUS_OPEN, $payment->status);
         $this->assertSame(PaymentProvider::TYPE_MANDATE, $payment->type);
         $this->assertSame(0, $payment->amount);
 
         $post = [
             'id' => "evt_1GlZ814fj3SIEU8wtxMZ4Nsa",
             'object' => "event",
             'api_version' => "2020-03-02",
             'created' => 1590147209,
             'data' => [
                 'object' => [
                     'id' => $payment->id,
                     'object' => "setup_intent",
                     'client_secret' => "pi_1GlZ7w4fj3SIEU8w1RlBpN4l_secret_UYRNDTUUU7nkYHpOLZMb3uf48",
                     'created' => 1590147204,
                     'customer' => "cus_HKDZ53OsKdlM83",
                     'last_setup_error' => null,
                     'metadata' => [],
                     'status' => "succeeded"
                 ]
             ],
             'type' => "setup_intent.succeeded"
         ];
 
         // Test payment succeeded event
         $response = $this->webhookRequest($post);
         $response->assertStatus(200);
 
         $payment->refresh();
 
         $this->assertSame(PaymentProvider::STATUS_PAID, $payment->status);
         $this->assertSame($payment->id, $wallet->fresh()->getSetting('stripe_mandate_id'));
 
         // TODO: test other setup_intent.* events
     }
 
     /**
      * Test automatic payment charges
      *
      * @group stripe
      */
     public function testTopUpAndWebhook(): void
     {
         $this->markTestIncomplete();
 
         Bus::fake();
 
         $user = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
 
         // Stripe API does not allow us to create a mandate easily
         // That's why we we'll mock API responses
         // Create a fake mandate
         $wallet->setSettings([
             'mandate_amount' => 20.10,
             'mandate_balance' => 10,
             'stripe_mandate_id' => 'AAA',
         ]);
 
         $setupIntent = json_encode([
                 "id" => "AAA",
                 "object" => "setup_intent",
                 "created" => 123456789,
                 "payment_method" => "pm_YYY",
                 "status" => "succeeded",
                 "usage" => "off_session",
                 "customer" => null
         ]);
 
         $paymentMethod = json_encode([
                 "id" => "pm_YYY",
                 "object" => "payment_method",
                 "card" => [
                     "brand" => "visa",
                     "country" => "US",
                     "last4" => "4242"
                 ],
                 "created" => 123456789,
                 "type" => "card"
         ]);
 
         $paymentIntent = json_encode([
                 "id" => "pi_XX",
                 "object" => "payment_intent",
                 "created" => 123456789,
                 "amount" => 2010,
                 "currency" => "chf",
                 "description" => "Kolab Recurring Payment"
         ]);
 
         $client = $this->mockStripe();
         $client->addResponse($setupIntent);
         $client->addResponse($paymentMethod);
         $client->addResponse($setupIntent);
         $client->addResponse($paymentIntent);
 
         // Expect a recurring payment as we have a valid mandate at this point
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertTrue($result);
 
         // Check that the payments table contains a new record with proper amount
         // There should be two records, one for the first payment and another for
         // the recurring payment
         $this->assertCount(1, $wallet->payments()->get());
         $payment = $wallet->payments()->first();
         $this->assertSame(2010, $payment->amount);
         $this->assertSame(\config('app.name') . " Recurring Payment", $payment->description);
         $this->assertSame("pi_XX", $payment->id);
 
         // Expect no payment if the mandate is disabled
         $wallet->setSetting('mandate_disabled', 1);
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(1, $wallet->payments()->get());
 
         // Expect no payment if balance is ok
         $wallet->setSetting('mandate_disabled', null);
         $wallet->balance = 1000;
         $wallet->save();
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(1, $wallet->payments()->get());
 
         // Expect no payment if the top-up amount is not enough
         $wallet->setSetting('mandate_disabled', null);
         $wallet->balance = -2050;
         $wallet->save();
+
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(1, $wallet->payments()->get());
 
         Bus::assertDispatchedTimes(\App\Jobs\PaymentMandateDisabledEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentMandateDisabledEmail::class, function ($job) use ($wallet) {
             $job_wallet = $this->getObjectProperty($job, 'wallet');
             return $job_wallet->id === $wallet->id;
         });
 
         // Expect no payment if there's no mandate
         $wallet->setSetting('mollie_mandate_id', null);
         $wallet->balance = 0;
         $wallet->save();
         $result = PaymentsController::topUpWallet($wallet);
         $this->assertFalse($result);
         $this->assertCount(1, $wallet->payments()->get());
 
         Bus::assertDispatchedTimes(\App\Jobs\PaymentMandateDisabledEmail::class, 1);
 
         $this->unmockStripe();
 
         // Test webhook
 
         $post = [
             'id' => "evt_1GlZ814fj3SIEU8wtxMZ4Nsa",
             'object' => "event",
             'api_version' => "2020-03-02",
             'created' => 1590147209,
             'data' => [
                 'object' => [
                     'id' => $payment->id,
                     'object' => "payment_intent",
                     'amount' => 2010,
                     'capture_method' => "automatic",
                     'created' => 1590147204,
                     'currency' => "chf",
                     'customer' => "cus_HKDZ53OsKdlM83",
                     'last_payment_error' => null,
                     'metadata' => [],
                     'receipt_email' => "payment-test@kolabnow.com",
                     'status' => "succeeded"
                 ]
             ],
             'type' => "payment_intent.succeeded"
         ];
 
         // Test payment succeeded event
         $response = $this->webhookRequest($post);
         $response->assertStatus(200);
 
         $this->assertSame(PaymentProvider::STATUS_PAID, $payment->fresh()->status);
         $this->assertEquals(2010, $wallet->fresh()->balance);
         $transaction = $wallet->transactions()
             ->where('type', Transaction::WALLET_CREDIT)->get()->last();
 
         $this->assertSame(2010, $transaction->amount);
         $this->assertSame(
             "Auto-payment transaction {$payment->id} using Stripe",
             $transaction->description
         );
 
         // Assert that email notification job has been dispatched
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
             $job_payment = $this->getObjectProperty($job, 'payment');
             return $job_payment->id === $payment->id;
         });
 
         Bus::fake();
 
         // Test for payment failure ('failed' status)
         $payment->refresh();
         $payment->status = PaymentProvider::STATUS_OPEN;
         $payment->save();
 
         $wallet->setSetting('mandate_disabled', null);
 
         $post['type'] = "payment_intent.payment_failed";
         $post['data']['object']['status'] = 'failed';
 
         $response = $this->webhookRequest($post);
         $response->assertStatus(200);
 
         $wallet->refresh();
 
         $this->assertSame(PaymentProvider::STATUS_FAILED, $payment->fresh()->status);
         $this->assertEquals(2010, $wallet->balance);
         $this->assertTrue(!empty($wallet->getSetting('mandate_disabled')));
 
         // Assert that email notification job has been dispatched
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 1);
         Bus::assertDispatched(\App\Jobs\PaymentEmail::class, function ($job) use ($payment) {
             $job_payment = $this->getObjectProperty($job, 'payment');
             return $job_payment->id === $payment->id;
         });
 
         Bus::fake();
 
         // Test for payment failure ('canceled' status)
         $payment->refresh();
         $payment->status = PaymentProvider::STATUS_OPEN;
         $payment->save();
 
         $post['type'] = "payment_intent.canceled";
         $post['data']['object']['status'] = 'canceled';
 
         $response = $this->webhookRequest($post);
         $response->assertStatus(200);
 
         $this->assertSame(PaymentProvider::STATUS_CANCELED, $payment->fresh()->status);
         $this->assertEquals(2010, $wallet->fresh()->balance);
 
         // Assert that email notification job wasn't dispatched,
         // it is expected only for recurring payments
         Bus::assertDispatchedTimes(\App\Jobs\PaymentEmail::class, 0);
     }
 
     /**
      * Generate Stripe-Signature header for a webhook payload
      */
     protected function webhookRequest($post)
     {
         $secret = \config('services.stripe.webhook_secret');
         $ts = time();
 
         $payload = "$ts." . json_encode($post);
         $sig = sprintf('t=%d,v1=%s', $ts, \hash_hmac('sha256', $payload, $secret));
 
         return $this->withHeaders(['Stripe-Signature' => $sig])
             ->json('POST', "api/webhooks/payment/stripe", $post);
     }
 }
diff --git a/src/tests/Feature/Controller/WalletsTest.php b/src/tests/Feature/Controller/WalletsTest.php
index 3aae3d01..25291f9f 100644
--- a/src/tests/Feature/Controller/WalletsTest.php
+++ b/src/tests/Feature/Controller/WalletsTest.php
@@ -1,336 +1,336 @@
 <?php
 
 namespace Tests\Feature\Controller;
 
 use App\Http\Controllers\API\V4\WalletsController;
 use App\Payment;
 use App\Providers\PaymentProvider;
 use App\Transaction;
 use Carbon\Carbon;
 use Tests\TestCase;
 
 class WalletsTest extends TestCase
 {
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->deleteTestUser('wallets-controller@kolabnow.com');
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         $this->deleteTestUser('wallets-controller@kolabnow.com');
 
         parent::tearDown();
     }
 
 
     /**
      * Test for getWalletNotice() method
      */
     public function testGetWalletNotice(): void
     {
         $user = $this->getTestUser('wallets-controller@kolabnow.com');
         $package = \App\Package::where('title', 'kolab')->first();
         $user->assignPackage($package);
         $wallet = $user->wallets()->first();
 
         $controller = new WalletsController();
         $method = new \ReflectionMethod($controller, 'getWalletNotice');
         $method->setAccessible(true);
 
         // User/entitlements created today, balance=0
         $notice = $method->invoke($controller, $wallet);
 
         $this->assertSame('You are in your free trial period.', $notice);
 
         $wallet->owner->created_at = Carbon::now()->subDays(15);
         $wallet->owner->save();
 
         $notice = $method->invoke($controller, $wallet);
 
         $this->assertSame('Your free trial is about to end, top up to continue.', $notice);
 
         // User/entitlements created today, balance=-10 CHF
         $wallet->balance = -1000;
         $notice = $method->invoke($controller, $wallet);
 
         $this->assertSame('You are out of credit, top up your balance now.', $notice);
 
         // User/entitlements created slightly more than a month ago, balance=9,99 CHF (monthly)
         $wallet->owner->created_at = Carbon::now()->subMonthsWithoutOverflow(1)->subDays(1);
         $wallet->owner->save();
 
         $wallet->balance = 999;
         $notice = $method->invoke($controller, $wallet);
 
         $this->assertRegExp('/\((1 month|4 weeks)\)/', $notice);
 
         // Old entitlements, 100% discount
         $this->backdateEntitlements($wallet->entitlements, Carbon::now()->subDays(40));
         $discount = \App\Discount::where('discount', 100)->first();
         $wallet->discount()->associate($discount);
 
         $notice = $method->invoke($controller, $wallet->refresh());
 
         $this->assertSame(null, $notice);
     }
 
     /**
      * Test fetching pdf receipt
      */
     public function testReceiptDownload(): void
     {
         $user = $this->getTestUser('wallets-controller@kolabnow.com');
-        $john = $this->getTestUser('john@klab.org');
+        $john = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
 
         // Unauth access not allowed
         $response = $this->get("api/v4/wallets/{$wallet->id}/receipts/2020-05");
         $response->assertStatus(401);
         $response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}/receipts/2020-05");
         $response->assertStatus(403);
 
         // Invalid receipt id (current month)
         $receiptId = date('Y-m');
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts/{$receiptId}");
         $response->assertStatus(404);
 
         // Invalid receipt id
         $receiptId = '1000-03';
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts/{$receiptId}");
         $response->assertStatus(404);
 
         // Valid receipt id
         $year = intval(date('Y')) - 1;
         $receiptId = "$year-12";
         $filename = \config('app.name') . " Receipt for $year-12";
 
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts/{$receiptId}");
 
         $response->assertStatus(200);
         $response->assertHeader('content-type', 'application/pdf');
         $response->assertHeader('content-disposition', 'attachment; filename="' . $filename . '"');
         $response->assertHeader('content-length');
 
         $length = $response->headers->get('content-length');
         $content = $response->content();
         $this->assertStringStartsWith("%PDF-1.", $content);
         $this->assertEquals(strlen($content), $length);
     }
 
     /**
      * Test fetching list of receipts
      */
     public function testReceipts(): void
     {
         $user = $this->getTestUser('wallets-controller@kolabnow.com');
-        $john = $this->getTestUser('john@klab.org');
+        $john = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
         $wallet->payments()->delete();
 
         // Unauth access not allowed
         $response = $this->get("api/v4/wallets/{$wallet->id}/receipts");
         $response->assertStatus(401);
         $response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}/receipts");
         $response->assertStatus(403);
 
         // Empty list expected
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame([], $json['list']);
         $this->assertSame(1, $json['page']);
         $this->assertSame(0, $json['count']);
         $this->assertSame(false, $json['hasMore']);
 
         // Insert a payment to the database
         $date = Carbon::create(intval(date('Y')) - 1, 4, 30);
         $payment = Payment::create([
                 'id' => 'AAA1',
                 'status' => PaymentProvider::STATUS_PAID,
                 'type' => PaymentProvider::TYPE_ONEOFF,
                 'description' => 'Paid in April',
                 'wallet_id' => $wallet->id,
                 'provider' => 'stripe',
                 'amount' => 1111,
         ]);
         $payment->updated_at = $date;
         $payment->save();
 
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/receipts");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame([$date->format('Y-m')], $json['list']);
         $this->assertSame(1, $json['page']);
         $this->assertSame(1, $json['count']);
         $this->assertSame(false, $json['hasMore']);
     }
 
     /**
      * Test fetching a wallet (GET /api/v4/wallets/:id)
      */
     public function testShow(): void
     {
         $john = $this->getTestUser('john@kolab.org');
         $jack = $this->getTestUser('jack@kolab.org');
         $wallet = $john->wallets()->first();
 
         // Accessing a wallet of someone else
         $response = $this->actingAs($jack)->get("api/v4/wallets/{$wallet->id}");
         $response->assertStatus(403);
 
         // Accessing non-existing wallet
         $response = $this->actingAs($jack)->get("api/v4/wallets/aaa");
         $response->assertStatus(404);
 
         // Wallet owner
         $response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertSame($wallet->id, $json['id']);
         $this->assertSame('CHF', $json['currency']);
         $this->assertSame($wallet->balance, $json['balance']);
         $this->assertTrue(empty($json['description']));
         $this->assertTrue(!empty($json['notice']));
     }
 
     /**
      * Test fetching wallet transactions
      */
     public function testTransactions(): void
     {
         $package_kolab = \App\Package::where('title', 'kolab')->first();
         $user = $this->getTestUser('wallets-controller@kolabnow.com');
         $user->assignPackage($package_kolab);
-        $john = $this->getTestUser('john@klab.org');
+        $john = $this->getTestUser('john@kolab.org');
         $wallet = $user->wallets()->first();
 
         // Unauth access not allowed
         $response = $this->get("api/v4/wallets/{$wallet->id}/transactions");
         $response->assertStatus(401);
         $response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}/transactions");
         $response->assertStatus(403);
 
         // Expect empty list
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame([], $json['list']);
         $this->assertSame(1, $json['page']);
         $this->assertSame(0, $json['count']);
         $this->assertSame(false, $json['hasMore']);
 
         // Create some sample transactions
         $transactions = $this->createTestTransactions($wallet);
         $transactions = array_reverse($transactions);
         $pages = array_chunk($transactions, 10 /* page size*/);
 
         // Get the first page
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame(1, $json['page']);
         $this->assertSame(10, $json['count']);
         $this->assertSame(true, $json['hasMore']);
         $this->assertCount(10, $json['list']);
         foreach ($pages[0] as $idx => $transaction) {
             $this->assertSame($transaction->id, $json['list'][$idx]['id']);
             $this->assertSame($transaction->type, $json['list'][$idx]['type']);
             $this->assertSame($transaction->shortDescription(), $json['list'][$idx]['description']);
             $this->assertFalse($json['list'][$idx]['hasDetails']);
             $this->assertFalse(array_key_exists('user', $json['list'][$idx]));
         }
 
         $search = null;
 
         // Get the second page
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions?page=2");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame(2, $json['page']);
         $this->assertSame(2, $json['count']);
         $this->assertSame(false, $json['hasMore']);
         $this->assertCount(2, $json['list']);
         foreach ($pages[1] as $idx => $transaction) {
             $this->assertSame($transaction->id, $json['list'][$idx]['id']);
             $this->assertSame($transaction->type, $json['list'][$idx]['type']);
             $this->assertSame($transaction->shortDescription(), $json['list'][$idx]['description']);
             $this->assertSame(
                 $transaction->type == Transaction::WALLET_DEBIT,
                 $json['list'][$idx]['hasDetails']
             );
             $this->assertFalse(array_key_exists('user', $json['list'][$idx]));
 
             if ($transaction->type == Transaction::WALLET_DEBIT) {
                 $search = $transaction->id;
             }
         }
 
         // Get a non-existing page
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions?page=3");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame(3, $json['page']);
         $this->assertSame(0, $json['count']);
         $this->assertSame(false, $json['hasMore']);
         $this->assertCount(0, $json['list']);
 
         // Sub-transaction searching
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions?transaction=123");
         $response->assertStatus(404);
 
         $response = $this->actingAs($user)->get("api/v4/wallets/{$wallet->id}/transactions?transaction={$search}");
         $response->assertStatus(200);
 
         $json = $response->json();
 
         $this->assertCount(5, $json);
         $this->assertSame('success', $json['status']);
         $this->assertSame(1, $json['page']);
         $this->assertSame(2, $json['count']);
         $this->assertSame(false, $json['hasMore']);
         $this->assertCount(2, $json['list']);
         $this->assertSame(Transaction::ENTITLEMENT_BILLED, $json['list'][0]['type']);
         $this->assertSame(Transaction::ENTITLEMENT_BILLED, $json['list'][1]['type']);
 
         // Test that John gets 404 if he tries to access
         // someone else's transaction ID on his wallet's endpoint
         $wallet = $john->wallets()->first();
         $response = $this->actingAs($john)->get("api/v4/wallets/{$wallet->id}/transactions?transaction={$search}");
         $response->assertStatus(404);
     }
 }
diff --git a/src/tests/Feature/DomainTest.php b/src/tests/Feature/DomainTest.php
index 6d57ba08..63f47c59 100644
--- a/src/tests/Feature/DomainTest.php
+++ b/src/tests/Feature/DomainTest.php
@@ -1,221 +1,221 @@
 <?php
 
 namespace Tests\Feature;
 
 use App\Domain;
 use App\Entitlement;
 use App\Sku;
 use App\User;
 use Illuminate\Foundation\Testing\WithFaker;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class DomainTest extends TestCase
 {
     private $domains = [
         'public-active.com',
         'gmail.com',
         'ci-success-cname.kolab.org',
         'ci-success-txt.kolab.org',
         'ci-failure-cname.kolab.org',
         'ci-failure-txt.kolab.org',
         'ci-failure-none.kolab.org',
     ];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         foreach ($this->domains as $domain) {
             $this->deleteTestDomain($domain);
         }
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         foreach ($this->domains as $domain) {
             $this->deleteTestDomain($domain);
         }
 
         parent::tearDown();
     }
 
     /**
      * Test domain create/creating observer
      */
     public function testCreate(): void
     {
         Queue::fake();
 
         $domain = Domain::create([
                 'namespace' => 'GMAIL.COM',
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         $result = Domain::where('namespace', 'gmail.com')->first();
 
         $this->assertSame('gmail.com', $result->namespace);
         $this->assertSame($domain->id, $result->id);
         $this->assertSame($domain->type, $result->type);
-        $this->assertSame(Domain::STATUS_NEW | Domain::STATUS_ACTIVE, $result->status);
+        $this->assertSame(Domain::STATUS_NEW, $result->status);
     }
 
     /**
      * Test domain creating jobs
      */
     public function testCreateJobs(): void
     {
         // Fake the queue, assert that no jobs were pushed...
         Queue::fake();
         Queue::assertNothingPushed();
 
         $domain = Domain::create([
                 'namespace' => 'gmail.com',
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         Queue::assertPushed(\App\Jobs\Domain\CreateJob::class, 1);
 
         Queue::assertPushed(
             \App\Jobs\Domain\CreateJob::class,
             function ($job) use ($domain) {
                 $domainId = TestCase::getObjectProperty($job, 'domainId');
                 $domainNamespace = TestCase::getObjectProperty($job, 'domainNamespace');
 
                 return $domainId === $domain->id &&
                     $domainNamespace === $domain->namespace;
             }
         );
 
         $job = new \App\Jobs\Domain\CreateJob($domain->id);
         $job->handle();
     }
 
     /**
      * Tests getPublicDomains() method
      */
     public function testGetPublicDomains(): void
     {
         $public_domains = Domain::getPublicDomains();
 
         $this->assertNotContains('public-active.com', $public_domains);
 
         $queue = Queue::fake();
 
         $domain = Domain::create([
                 'namespace' => 'public-active.com',
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_EXTERNAL,
         ]);
 
         // External domains should not be returned
         $public_domains = Domain::getPublicDomains();
         $this->assertNotContains('public-active.com', $public_domains);
 
         $domain = Domain::where('namespace', 'public-active.com')->first();
         $domain->type = Domain::TYPE_PUBLIC;
         $domain->save();
 
         $public_domains = Domain::getPublicDomains();
         $this->assertContains('public-active.com', $public_domains);
     }
 
     /**
      * Test domain (ownership) confirmation
      *
      * @group dns
      */
     public function testConfirm(): void
     {
         /*
             DNS records for positive and negative tests - kolab.org:
 
             ci-success-cname                A       212.103.80.148
             ci-success-cname                MX      10  mx01.kolabnow.com.
             ci-success-cname                TXT     "v=spf1 mx -all"
             kolab-verify.ci-success-cname   CNAME   2b719cfa4e1033b1e1e132977ed4fe3e.ci-success-cname
 
             ci-failure-cname                A       212.103.80.148
             ci-failure-cname                MX      10  mx01.kolabnow.com.
             kolab-verify.ci-failure-cname   CNAME   2b719cfa4e1033b1e1e132977ed4fe3e.ci-failure-cname
 
             ci-success-txt                  A       212.103.80.148
             ci-success-txt                  MX      10  mx01.kolabnow.com.
             ci-success-txt                  TXT     "v=spf1 mx -all"
             ci-success-txt                  TXT     "kolab-verify=de5d04ababb52d52e2519a2f16d11422"
 
             ci-failure-txt                  A       212.103.80.148
             ci-failure-txt                  MX      10  mx01.kolabnow.com.
             kolab-verify.ci-failure-txt     TXT     "kolab-verify=de5d04ababb52d52e2519a2f16d11422"
 
             ci-failure-none                 A       212.103.80.148
             ci-failure-none                 MX      10  mx01.kolabnow.com.
         */
 
         $queue = Queue::fake();
 
         $domain_props = ['status' => Domain::STATUS_NEW, 'type' => Domain::TYPE_EXTERNAL];
 
         $domain = $this->getTestDomain('ci-failure-none.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm() === false);
         $this->assertFalse($domain->isConfirmed());
 
         $domain = $this->getTestDomain('ci-failure-txt.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm() === false);
         $this->assertFalse($domain->isConfirmed());
 
         $domain = $this->getTestDomain('ci-failure-cname.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm() === false);
         $this->assertFalse($domain->isConfirmed());
 
         $domain = $this->getTestDomain('ci-success-txt.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm());
         $this->assertTrue($domain->isConfirmed());
 
         $domain = $this->getTestDomain('ci-success-cname.kolab.org', $domain_props);
 
         $this->assertTrue($domain->confirm());
         $this->assertTrue($domain->isConfirmed());
     }
 
     /**
      * Test domain deletion
      */
     public function testDelete(): void
     {
         Queue::fake();
 
         $domain = $this->getTestDomain('gmail.com', [
                 'status' => Domain::STATUS_NEW,
                 'type' => Domain::TYPE_PUBLIC,
         ]);
 
         $domain->delete();
 
         $this->assertTrue($domain->fresh()->trashed());
         $this->assertFalse($domain->fresh()->isDeleted());
 
         // Delete the domain for real
         $job = new \App\Jobs\Domain\DeleteJob($domain->id);
         $job->handle();
 
         $this->assertTrue(Domain::withTrashed()->where('id', $domain->id)->first()->isDeleted());
 
         $domain->forceDelete();
 
         $this->assertCount(0, Domain::withTrashed()->where('id', $domain->id)->get());
     }
 }
diff --git a/src/tests/Functional/Methods/DomainTest.php b/src/tests/Functional/Methods/DomainTest.php
new file mode 100644
index 00000000..604f6c29
--- /dev/null
+++ b/src/tests/Functional/Methods/DomainTest.php
@@ -0,0 +1,114 @@
+<?php
+
+namespace Tests\Functional\Methods;
+
+use Illuminate\Support\Facades\Queue;
+use Tests\TestCase;
+
+class DomainTest extends TestCase
+{
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        $this->domain = $this->getTestDomain(
+            'test.domain',
+            [
+                'status' => \App\Domain::STATUS_CONFIRMED | \App\Domain::STATUS_VERIFIED,
+                'type' => \App\Domain::TYPE_EXTERNAL
+            ]
+        );
+    }
+
+    public function tearDown(): void
+    {
+        $this->deleteTestDomain('test.domain');
+
+        parent::tearDown();
+    }
+
+    /**
+     * Verify we can suspend an active domain.
+     */
+    public function testSuspendForActiveDomain()
+    {
+        Queue::fake();
+
+        $this->domain->status |= \App\Domain::STATUS_ACTIVE;
+
+        $this->assertFalse($this->domain->isSuspended());
+        $this->assertTrue($this->domain->isActive());
+
+        $this->domain->suspend();
+
+        $this->assertTrue($this->domain->isSuspended());
+        $this->assertFalse($this->domain->isActive());
+    }
+
+    /**
+     * Verify we can unsuspend a suspended domain
+     */
+    public function testUnsuspendForSuspendedDomain()
+    {
+        Queue::fake();
+
+        $this->domain->status |= \App\Domain::STATUS_SUSPENDED;
+
+        $this->assertTrue($this->domain->isSuspended());
+        $this->assertFalse($this->domain->isActive());
+
+        $this->domain->unsuspend();
+
+        $this->assertFalse($this->domain->isSuspended());
+        $this->assertTrue($this->domain->isActive());
+    }
+
+    /**
+     * Verify we can unsuspend a suspended domain that wasn't confirmed
+     */
+    public function testUnsuspendForSuspendedUnconfirmedDomain()
+    {
+        Queue::fake();
+
+        $this->domain->status = \App\Domain::STATUS_NEW | \App\Domain::STATUS_SUSPENDED;
+
+        $this->assertTrue($this->domain->isNew());
+        $this->assertTrue($this->domain->isSuspended());
+        $this->assertFalse($this->domain->isActive());
+        $this->assertFalse($this->domain->isConfirmed());
+        $this->assertFalse($this->domain->isVerified());
+
+        $this->domain->unsuspend();
+
+        $this->assertTrue($this->domain->isNew());
+        $this->assertFalse($this->domain->isSuspended());
+        $this->assertFalse($this->domain->isActive());
+        $this->assertFalse($this->domain->isConfirmed());
+        $this->assertFalse($this->domain->isVerified());
+    }
+
+    /**
+     * Verify we can unsuspend a suspended domain that was verified but not confirmed
+     */
+    public function testUnsuspendForSuspendedVerifiedUnconfirmedDomain()
+    {
+        Queue::fake();
+
+        $this->domain->status = \App\Domain::STATUS_NEW | \App\Domain::STATUS_SUSPENDED | \App\Domain::STATUS_VERIFIED;
+
+        $this->assertTrue($this->domain->isNew());
+        $this->assertTrue($this->domain->isSuspended());
+        $this->assertFalse($this->domain->isActive());
+        $this->assertFalse($this->domain->isConfirmed());
+        $this->assertTrue($this->domain->isVerified());
+
+        $this->domain->unsuspend();
+
+        $this->assertTrue($this->domain->isNew());
+        $this->assertFalse($this->domain->isSuspended());
+        $this->assertFalse($this->domain->isActive());
+        $this->assertFalse($this->domain->isConfirmed());
+        $this->assertTrue($this->domain->isVerified());
+    }
+
+}
diff --git a/src/tests/Unit/DomainTest.php b/src/tests/Unit/DomainTest.php
index 46b7b4ba..37ab96e4 100644
--- a/src/tests/Unit/DomainTest.php
+++ b/src/tests/Unit/DomainTest.php
@@ -1,117 +1,138 @@
 <?php
 
 namespace Tests\Unit;
 
 use App\Domain;
 use Tests\TestCase;
 
 class DomainTest extends TestCase
 {
     /**
      * Test basic Domain funtionality
      */
     public function testDomainStatus(): void
     {
         $statuses = [
             Domain::STATUS_NEW,
             Domain::STATUS_ACTIVE,
             Domain::STATUS_CONFIRMED,
             Domain::STATUS_SUSPENDED,
             Domain::STATUS_DELETED,
             Domain::STATUS_LDAP_READY,
             Domain::STATUS_VERIFIED,
         ];
 
         $domains = \App\Utils::powerSet($statuses);
 
-        foreach ($domains as $domain_statuses) {
+        foreach ($domains as $domainStatuses) {
             $domain = new Domain(
                 [
                     'namespace' => 'test.com',
-                    'status' => \array_sum($domain_statuses),
+                    'status' => \array_sum($domainStatuses),
                     'type' => Domain::TYPE_EXTERNAL
                 ]
             );
 
-            $this->assertTrue($domain->isNew() === in_array(Domain::STATUS_NEW, $domain_statuses));
-            $this->assertTrue($domain->isActive() === in_array(Domain::STATUS_ACTIVE, $domain_statuses));
-            $this->assertTrue($domain->isConfirmed() === in_array(Domain::STATUS_CONFIRMED, $domain_statuses));
-            $this->assertTrue($domain->isSuspended() === in_array(Domain::STATUS_SUSPENDED, $domain_statuses));
-            $this->assertTrue($domain->isDeleted() === in_array(Domain::STATUS_DELETED, $domain_statuses));
-            $this->assertTrue($domain->isLdapReady() === in_array(Domain::STATUS_LDAP_READY, $domain_statuses));
-            $this->assertTrue($domain->isVerified() === in_array(Domain::STATUS_VERIFIED, $domain_statuses));
-        }
-    }
+            $domainStatuses = [];
 
-    /**
-     * Test setStatusAttribute exception
-     */
-    public function testDomainStatusInvalid(): void
-    {
-        $this->expectException(\Exception::class);
-
-        $domain = new Domain(
-            [
-                'namespace' => 'test.com',
-                'status' => 1234567,
-            ]
-        );
+            foreach ($statuses as $status) {
+                if ($domain->status & $status) {
+                    $domainStatuses[] = $status;
+                }
+            }
+
+            $this->assertSame($domain->status, \array_sum($domainStatuses));
+
+            // either one is true, but not both
+            $this->assertSame(
+                $domain->isNew() === in_array(Domain::STATUS_NEW, $domainStatuses),
+                $domain->isActive() === in_array(Domain::STATUS_ACTIVE, $domainStatuses)
+            );
+
+            $this->assertTrue(
+                $domain->isNew() === in_array(Domain::STATUS_NEW, $domainStatuses)
+            );
+
+            $this->assertTrue(
+                $domain->isActive() === in_array(Domain::STATUS_ACTIVE, $domainStatuses)
+            );
+
+            $this->assertTrue(
+                $domain->isConfirmed() === in_array(Domain::STATUS_CONFIRMED, $domainStatuses)
+            );
+
+            $this->assertTrue(
+                $domain->isSuspended() === in_array(Domain::STATUS_SUSPENDED, $domainStatuses)
+            );
+
+            $this->assertTrue(
+                $domain->isDeleted() === in_array(Domain::STATUS_DELETED, $domainStatuses)
+            );
+
+            $this->assertTrue(
+                $domain->isLdapReady() === in_array(Domain::STATUS_LDAP_READY, $domainStatuses)
+            );
+
+            $this->assertTrue(
+                $domain->isVerified() === in_array(Domain::STATUS_VERIFIED, $domainStatuses)
+            );
+        }
     }
 
     /**
      * Test basic Domain funtionality
      */
     public function testDomainType(): void
     {
         $types = [
             Domain::TYPE_PUBLIC,
             Domain::TYPE_HOSTED,
             Domain::TYPE_EXTERNAL,
         ];
 
         $domains = \App\Utils::powerSet($types);
 
         foreach ($domains as $domain_types) {
             $domain = new Domain(
                 [
                     'namespace' => 'test.com',
                     'status' => Domain::STATUS_NEW,
                     'type' => \array_sum($domain_types),
                 ]
             );
 
             $this->assertTrue($domain->isPublic() === in_array(Domain::TYPE_PUBLIC, $domain_types));
             $this->assertTrue($domain->isHosted() === in_array(Domain::TYPE_HOSTED, $domain_types));
             $this->assertTrue($domain->isExternal() === in_array(Domain::TYPE_EXTERNAL, $domain_types));
         }
     }
 
     /**
      * Test domain hash generation
      */
     public function testHash(): void
     {
         $domain = new Domain([
             'namespace' => 'test.com',
             'status' => Domain::STATUS_NEW,
         ]);
 
         $hash_code = $domain->hash();
 
         $this->assertRegExp('/^[a-f0-9]{32}$/', $hash_code);
 
         $hash_text = $domain->hash(Domain::HASH_TEXT);
 
         $this->assertRegExp('/^kolab-verify=[a-f0-9]{32}$/', $hash_text);
 
         $this->assertSame($hash_code, str_replace('kolab-verify=', '', $hash_text));
 
         $hash_cname = $domain->hash(Domain::HASH_CNAME);
 
         $this->assertSame('kolab-verify', $hash_cname);
 
         $hash_code2 = $domain->hash(Domain::HASH_CODE);
 
         $this->assertSame($hash_code, $hash_code2);
     }
 }
diff --git a/src/tests/Unit/Methods/DomainTest.php b/src/tests/Unit/Methods/DomainTest.php
new file mode 100644
index 00000000..5300bc40
--- /dev/null
+++ b/src/tests/Unit/Methods/DomainTest.php
@@ -0,0 +1,159 @@
+<?php
+
+namespace Tests\Unit\Methods;
+
+use Tests\TestCase;
+
+class DomainTest extends TestCase
+{
+    public function setUp(): void
+    {
+        parent::setUp();
+
+        $this->domain = new \App\Domain();
+    }
+
+    /**
+     * Test lower-casing namespace attribute.
+     */
+    public function testSetNamespaceAttributeLowercases()
+    {
+        $this->domain = new \App\Domain();
+
+        $this->domain->namespace = 'UPPERCASE';
+
+        $this->assertTrue($this->domain->namespace === 'uppercase');
+    }
+
+    /**
+     * Test setting the status to something invalid
+     */
+    public function testSetStatusAttributeInvalid()
+    {
+        $this->expectException(\Exception::class);
+
+        $this->domain->status = 123456;
+    }
+
+    /**
+     * Test public domain.
+     */
+    public function testSetStatusAttributeOnPublicDomain()
+    {
+        $this->domain->{'type'} = \App\Domain::TYPE_PUBLIC;
+
+        $this->domain->status = 115;
+
+        $this->assertTrue($this->domain->status == 115);
+    }
+
+    /**
+     * Test status mutations
+     */
+    public function testSetStatusAttributeActiveMakesForNotNew()
+    {
+        $this->domain->status = \App\Domain::STATUS_NEW;
+
+        $this->assertTrue($this->domain->isNew());
+        $this->assertFalse($this->domain->isActive());
+
+        $this->domain->status |= \App\Domain::STATUS_ACTIVE;
+
+        $this->assertFalse($this->domain->isNew());
+        $this->assertTrue($this->domain->isActive());
+    }
+
+    /**
+     * Verify setting confirmed sets verified.
+     */
+    public function testSetStatusAttributeConfirmedMakesForVerfied()
+    {
+        $this->domain->status = \App\Domain::STATUS_CONFIRMED;
+
+        $this->assertTrue($this->domain->isConfirmed());
+        $this->assertTrue($this->domain->isVerified());
+    }
+
+    /**
+     * Verify setting confirmed sets active.
+     */
+    public function testSetStatusAttributeConfirmedMakesForActive()
+    {
+        $this->domain->status = \App\Domain::STATUS_CONFIRMED;
+
+        $this->assertTrue($this->domain->isConfirmed());
+        $this->assertTrue($this->domain->isActive());
+    }
+
+    /**
+     * Verify setting deleted drops active.
+     */
+    public function testSetStatusAttributeDeletedVoidsActive()
+    {
+        $this->domain->status = \App\Domain::STATUS_ACTIVE;
+
+        $this->assertTrue($this->domain->isActive());
+        $this->assertFalse($this->domain->isNew());
+        $this->assertFalse($this->domain->isDeleted());
+
+        $this->domain->status |= \App\Domain::STATUS_DELETED;
+
+        $this->assertFalse($this->domain->isActive());
+        $this->assertFalse($this->domain->isNew());
+        $this->assertTrue($this->domain->isDeleted());
+    }
+
+    /**
+     * Verify setting suspended drops active.
+     */
+    public function testSetStatusAttributeSuspendedVoidsActive()
+    {
+        $this->domain->status = \App\Domain::STATUS_ACTIVE;
+
+        $this->assertTrue($this->domain->isActive());
+        $this->assertFalse($this->domain->isSuspended());
+
+        $this->domain->status |= \App\Domain::STATUS_SUSPENDED;
+
+        $this->assertFalse($this->domain->isActive());
+        $this->assertTrue($this->domain->isSuspended());
+    }
+
+    /**
+     * Verify we can suspend a suspended domain without disaster.
+     *
+     * This doesn't change anything to trigger a save.
+     */
+    public function testSuspendForSuspendedDomain()
+    {
+        $this->domain->status = \App\Domain::STATUS_ACTIVE;
+
+        $this->domain->status |= \App\Domain::STATUS_SUSPENDED;
+
+        $this->assertTrue($this->domain->isSuspended());
+        $this->assertFalse($this->domain->isActive());
+
+        $this->domain->suspend();
+
+        $this->assertTrue($this->domain->isSuspended());
+        $this->assertFalse($this->domain->isActive());
+    }
+
+    /**
+     * Verify we can unsuspend an active (unsuspended) domain
+     *
+     * This doesn't change anything to trigger a save.
+     */
+    public function testUnsuspendForActiveDomain()
+    {
+        $this->domain->status = \App\Domain::STATUS_ACTIVE;
+
+        $this->assertFalse($this->domain->isSuspended());
+        $this->assertTrue($this->domain->isActive());
+
+        $this->domain->unsuspend();
+
+        $this->assertFalse($this->domain->isSuspended());
+        $this->assertTrue($this->domain->isActive());
+    }
+}