diff --git a/dashboard/src/components/MailRelaySettingsItem.vue b/dashboard/src/components/MailRelaySettingsItem.vue
index ecdf8de2d..3a29db33e 100644
--- a/dashboard/src/components/MailRelaySettingsItem.vue
+++ b/dashboard/src/components/MailRelaySettingsItem.vue
@@ -1,7 +1,7 @@
 <script setup>
 
 import { ref, useTemplateRef, computed } from 'vue';
-import { Button, Dialog, FormGroup, SingleSelect, TextInput, NumberInput, Checkbox, PasswordInput } from '@cloudron/pankow';
+import { Button, Dialog, FormGroup, SingleSelect, TextInput, NumberInput, Checkbox, MaskedInput } from '@cloudron/pankow';
 import SettingsItem from './SettingsItem.vue';
 import MailModel from '../models/MailModel.js';
 
@@ -63,6 +63,12 @@ function usesPasswordAuth(provider) {
     || provider === 'mailjet-smtp';
 }
 
+const form = useTemplateRef('form');
+const isFormValid = ref(false);
+function checkValidity() {
+  isFormValid.value = form.value.checkValidity();
+}
+
 function onProviderChange() {
   // reset the form
   host.value = '';
@@ -98,6 +104,8 @@ async function onShowDialog() {
   serverApiToken.value = result.relay.serverApiToken;
 
   dialog.value.open();
+
+  setTimeout(checkValidity, 100); // update state of the confirm button
 }
 
 async function onSubmit() {
@@ -110,7 +118,7 @@ async function onSubmit() {
 
   if (usesExternalServer(data.provider)) {
     data.username = username.value;
-    data.password = password.value;
+    if (password.value) data.password = password.value;
     data.host = host.value;
     data.port = parseInt(port.value);
     data.acceptSelfSignedCerts = acceptSelfSignedCerts.value;
@@ -119,15 +127,15 @@ async function onSubmit() {
 
   // fill in provider specific username/password usage
   if (data.provider === 'postmark-smtp') {
-    data.username = serverApiToken.value;
-    data.password = serverApiToken.value;
+    if (serverApiToken.value) data.username = serverApiToken.value;
+    if (serverApiToken.value) data.password = serverApiToken.value;
     data.forceFromAddress = true; // postmark requires the "From:" in mail to be a Sender Signature
   } else if (data.provider === 'sendgrid-smtp') {
     data.username = 'apikey';
-    data.password = serverApiToken.value;
+    if (serverApiToken.value) data.password = serverApiToken.value;
   } else if (data.provider === 'sparkpost-smtp') {
     data.username = 'SMTP_Injection';
-    data.password = serverApiToken.value;
+    if (serverApiToken.value) data.password = serverApiToken.value;
   }
 
   const [error] = await mailModel.setMailRelay(props.domain, data);
@@ -151,7 +159,7 @@ async function onSubmit() {
       :confirm-label="$t('main.dialog.save')"
       :confirm-busy="busy"
       :reject-label="$t('main.dialog.cancel')"
-      :reject-active="!busy"
+      :reject-active="!busy && isFormValid"
        reject-style="secondary"
       @confirm="onSubmit()"
     >
@@ -165,9 +173,9 @@ async function onSubmit() {
 
         <div class="text-danger" v-if="formError">{{ formError }}</div>
 
-        <form @submit.prevent="onSubmit()" autocomplete="off" v-if="usesExternalServer(provider)">
+        <form ref="form" @submit.prevent="onSubmit()" autocomplete="off" v-if="usesExternalServer(provider)" @input="checkValidity()">
           <fieldset :disabled="busy">
-            <input type="submit" style="display: none"/>
+            <input type="submit" style="display: none" :disabled="busy || !isFormValid"/>
 
             <FormGroup>
               <label for="hostInput">{{ $t('email.outbound.mailRelay.host') }}</label>
@@ -184,7 +192,7 @@ async function onSubmit() {
             <!-- Postmark, Sendgrid, SparkPost -->
             <FormGroup v-if="usesTokenAuth(provider)">
               <label for="serverApiTokenInput">{{ $t('email.outbound.mailRelay.apiTokenOrKey') }}</label>
-              <TextInput id="serverApiTokenInput" v-model="serverApiToken" required />
+              <MaskedInput id="serverApiTokenInput" v-model="serverApiToken" required />
             </FormGroup>
 
             <!-- Other -->
@@ -195,7 +203,7 @@ async function onSubmit() {
 
             <FormGroup v-if="usesPasswordAuth(provider)">
               <label for="passwordInput">{{ $t('email.outbound.mailRelay.password') }}</label>
-              <TextInput id="passwordInput" v-model="password" required />
+              <MaskedInput id="passwordInput" v-model="password" required />
             </FormGroup>
           </fieldset>
         </form>
diff --git a/src/mail.js b/src/mail.js
index 89ec239f9..8c76f37bb 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -1,65 +1,5 @@
 'use strict';
 
-exports = module.exports = {
-    getStatus,
-    checkConfiguration,
-
-    listDomains,
-
-    getDomain,
-    clearDomains,
-
-    removePrivateFields,
-
-    setDnsRecords,
-    upsertDnsRecords,
-
-    validateName,
-    validateDisplayName,
-
-    setMailFromValidation,
-    setCatchAllAddress,
-    setMailRelay,
-    setMailEnabled,
-    setBanner,
-
-    sendTestMail,
-
-    getMailboxCount,
-    listMailboxes,
-    listAllMailboxes,
-    getMailbox,
-    addMailbox,
-    updateMailbox,
-    delMailbox,
-
-    getAlias,
-    getAliases,
-    setAliases,
-    searchAlias,
-
-    getListCount,
-    getLists,
-    getList,
-    addList,
-    updateList,
-    delList,
-    resolveList,
-
-    checkStatus,
-
-    OWNERTYPE_USER: 'user',
-    OWNERTYPE_GROUP: 'group',
-    OWNERTYPE_APP: 'app',
-
-    TYPE_MAILBOX: 'mailbox',
-    TYPE_LIST: 'list',
-    TYPE_ALIAS: 'alias',
-
-    _delByDomain: delByDomain,
-    _updateDomain: updateDomain
-};
-
 const assert = require('node:assert'),
     BoxError = require('./boxerror.js'),
     constants = require('./constants.js'),
@@ -171,6 +111,44 @@ function validateDisplayName(name) {
     return null;
 }
 
+async function getDomain(domain) {
+    assert.strictEqual(typeof domain, 'string');
+
+    const result = await database.query(`SELECT ${MAILDB_FIELDS} FROM mail WHERE domain = ?`, [ domain ]);
+    if (result.length === 0) return null;
+    return postProcessDomain(result[0]);
+}
+
+async function updateDomain(domain, data) {
+    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof data, 'object');
+
+    const args = [ ];
+    const fields = [ ];
+    for (const k in data) {
+        if (k === 'catchAll' || k === 'banner') {
+            fields.push(`${k}Json = ?`);
+            args.push(JSON.stringify(data[k]));
+        } else if (k === 'relay') {
+            fields.push('relayJson = ?');
+            args.push(JSON.stringify(data[k]));
+        } else {
+            fields.push(k + ' = ?');
+            args.push(data[k]);
+        }
+    }
+    args.push(domain);
+
+    const result = await database.query('UPDATE mail SET ' + fields.join(', ') + ' WHERE domain=?', args);
+    if (result.affectedRows !== 1) throw new BoxError(BoxError.NOT_FOUND, 'Mail domain not found');
+}
+
+async function listDomains() {
+    const results = await database.query(`SELECT ${MAILDB_FIELDS} FROM mail ORDER BY domain`);
+    results.forEach(function (result) { postProcessDomain(result); });
+    return results;
+}
+
 async function checkOutboundPort25() {
     return await new Promise((resolve) => {
         const client = new net.Socket();
@@ -227,6 +205,15 @@ async function checkSmtpRelay(relay) {
     return result;
 }
 
+function txtToDict(txt) {
+    const dict = {};
+    txt.split(';').forEach(function(v) {
+        const p = v.trim().split('=');
+        dict[p[0]]=p[1];
+    });
+    return dict;
+}
+
 async function checkDkim(mailDomain) {
     assert.strictEqual(typeof mailDomain, 'object');
 
@@ -337,15 +324,6 @@ async function checkMx(mailDomain, mailFqdn) {
     return result;
 }
 
-function txtToDict(txt) {
-    const dict = {};
-    txt.split(';').forEach(function(v) {
-        const p = v.trim().split('=');
-        dict[p[0]]=p[1];
-    });
-    return dict;
-}
-
 async function checkDmarc(mailDomain) {
     assert.strictEqual(typeof mailDomain, 'object');
 
@@ -621,44 +599,6 @@ async function checkConfiguration() {
     return { status: markdownMessage === '', message: markdownMessage };
 }
 
-async function getDomain(domain) {
-    assert.strictEqual(typeof domain, 'string');
-
-    const result = await database.query(`SELECT ${MAILDB_FIELDS} FROM mail WHERE domain = ?`, [ domain ]);
-    if (result.length === 0) return null;
-    return postProcessDomain(result[0]);
-}
-
-async function updateDomain(domain, data) {
-    assert.strictEqual(typeof domain, 'string');
-    assert.strictEqual(typeof data, 'object');
-
-    const args = [ ];
-    const fields = [ ];
-    for (const k in data) {
-        if (k === 'catchAll' || k === 'banner') {
-            fields.push(`${k}Json = ?`);
-            args.push(JSON.stringify(data[k]));
-        } else if (k === 'relay') {
-            fields.push('relayJson = ?');
-            args.push(JSON.stringify(data[k]));
-        } else {
-            fields.push(k + ' = ?');
-            args.push(data[k]);
-        }
-    }
-    args.push(domain);
-
-    const result = await database.query('UPDATE mail SET ' + fields.join(', ') + ' WHERE domain=?', args);
-    if (result.affectedRows !== 1) throw new BoxError(BoxError.NOT_FOUND, 'Mail domain not found');
-}
-
-async function listDomains() {
-    const results = await database.query(`SELECT ${MAILDB_FIELDS} FROM mail ORDER BY domain`);
-    results.forEach(function (result) { postProcessDomain(result); });
-    return results;
-}
-
 // https://agari.zendesk.com/hc/en-us/articles/202952749-How-long-can-my-SPF-record-be-
 async function txtRecordsWithSpf(domain, mailFqdn) {
     assert.strictEqual(typeof domain, 'string');
@@ -738,12 +678,11 @@ async function clearDomains() {
     await database.query('DELETE FROM mail', []);
 }
 
-// remove all fields that should never be sent out via REST API
 function removePrivateFields(domain) {
     const result = _.pick(domain, ['domain', 'enabled', 'mailFromValidation', 'catchAll', 'relay', 'banner']);
     if ('password' in result.relay) {
-        if ('username' in result.relay && result.relay.username === result.relay.password) result.relay.username = constants.SECRET_PLACEHOLDER;
-        result.relay.password = constants.SECRET_PLACEHOLDER;
+        if ('username' in result.relay && result.relay.username === result.relay.password) delete result.relay.username;
+        delete result.relay.password;
     }
     return result;
 }
@@ -788,8 +727,10 @@ async function setMailRelay(domain, relay, options) {
     if (!domain) throw new BoxError(BoxError.NOT_FOUND, 'Mail domain not found');
 
     // inject current username/password
-    if (relay.username === constants.SECRET_PLACEHOLDER) relay.username = result.relay.username;
-    if (relay.password === constants.SECRET_PLACEHOLDER) relay.password = result.relay.password;
+    if ('password' in result.relay) {
+        if (!Object.hasOwn(relay, 'username')) relay.username = result.relay.username;
+        if (!Object.hasOwn(relay, 'password')) relay.password = result.relay.password;
+    }
 
     if (!options.skipVerify) {
         const result = await checkSmtpRelay(relay);
@@ -1235,3 +1176,63 @@ async function checkStatus() {
         await notifications.pin(notifications.TYPE_MAIL_STATUS, 'Email is not configured properly', result.message, {});
     }
 }
+
+exports = module.exports = {
+    getStatus,
+    checkConfiguration,
+
+    listDomains,
+
+    getDomain,
+    clearDomains,
+
+    removePrivateFields,
+
+    setDnsRecords,
+    upsertDnsRecords,
+
+    validateName,
+    validateDisplayName,
+
+    setMailFromValidation,
+    setCatchAllAddress,
+    setMailRelay,
+    setMailEnabled,
+    setBanner,
+
+    sendTestMail,
+
+    getMailboxCount,
+    listMailboxes,
+    listAllMailboxes,
+    getMailbox,
+    addMailbox,
+    updateMailbox,
+    delMailbox,
+
+    getAlias,
+    getAliases,
+    setAliases,
+    searchAlias,
+
+    getListCount,
+    getLists,
+    getList,
+    addList,
+    updateList,
+    delList,
+    resolveList,
+
+    checkStatus,
+
+    OWNERTYPE_USER: 'user',
+    OWNERTYPE_GROUP: 'group',
+    OWNERTYPE_APP: 'app',
+
+    TYPE_MAILBOX: 'mailbox',
+    TYPE_LIST: 'list',
+    TYPE_ALIAS: 'alias',
+
+    _delByDomain: delByDomain,
+    _updateDomain: updateDomain
+};