diff --git a/src/mail.js b/src/mail.js
index 9188c2fcb..8265bb09e 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -610,8 +610,8 @@ function add(domain, callback) {
         if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
 
         maildb.add(domain, function (error) {
-            if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new MailError(MailError.ALREADY_EXISTS, error.message));
-            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, error.message));
+            if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new MailError(MailError.ALREADY_EXISTS, 'Domain already exists'));
+            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, 'No such domain'));
             if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
 
             callback();
diff --git a/src/routes/domains.js b/src/routes/domains.js
index 42101203e..daa091e06 100644
--- a/src/routes/domains.js
+++ b/src/routes/domains.js
@@ -84,7 +84,7 @@ function del(req, res, next) {
         if (error && error.reason === DomainError.IN_USE) return next(new HttpError(409, 'Domain is still in use'));
         if (error) return next(new HttpError(500, error));
 
-        next(new HttpSuccess(204, {}));
+        next(new HttpSuccess(204));
     });
 }
 
diff --git a/src/routes/mail.js b/src/routes/mail.js
index 754654c61..5d78ff0ef 100644
--- a/src/routes/mail.js
+++ b/src/routes/mail.js
@@ -42,14 +42,16 @@ function get(req, res, next) {
 }
 
 function add(req, res, next) {
-    assert.strictEqual(typeof req.params.domain, 'string');
+    assert.strictEqual(typeof req.body, 'object');
 
-    mail.add(req.params.domain, function (error, result) {
+    if (typeof req.body.domain !== 'string') return next(new HttpError(400, 'domain must be a string'));
+
+    mail.add(req.body.domain, function (error) {
         if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
         if (error && error.reason === MailError.ALREADY_EXISTS) return next(new HttpError(400, error.message));
         if (error) return next(new HttpError(500, error));
 
-        next(new HttpSuccess(200, result));
+        next(new HttpSuccess(201, { domain: req.body.domain }));
     });
 }
 
@@ -60,7 +62,7 @@ function del(req, res, next) {
         if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
         if (error) return next(new HttpError(500, error));
 
-        next(new HttpSuccess(202, { }));
+        next(new HttpSuccess(204));
     });
 }
 
diff --git a/src/routes/user.js b/src/routes/user.js
index 58541159b..18891fa93 100644
--- a/src/routes/user.js
+++ b/src/routes/user.js
@@ -21,7 +21,6 @@ var assert = require('assert'),
     oauth2 = require('./oauth2.js'),
     user = require('../user.js'),
     UserError = user.UserError,
-    util = require('util'),
     _ = require('underscore');
 
 function auditSource(req) {
diff --git a/src/server.js b/src/server.js
index dd186f9a1..acd88bcda 100644
--- a/src/server.js
+++ b/src/server.js
@@ -211,8 +211,8 @@ function initializeExpressSync() {
 
     // email routes
     router.get ('/api/v1/mail/:domain',       settingsScope, routes.user.requireAdmin, routes.mail.get);
-    router.post('/api/v1/mail/:domain',       settingsScope, routes.user.requireAdmin, routes.mail.add);
-    router.del ('/api/v1/mail/:domain',       settingsScope, routes.user.requireAdmin, routes.mail.del);
+    router.post('/api/v1/mail',               settingsScope, routes.user.requireAdmin, routes.mail.add);
+    router.del ('/api/v1/mail/:domain',       settingsScope, routes.user.requireAdmin, routes.user.verifyPassword, routes.mail.del);
     router.get ('/api/v1/mail/:domain/status',       settingsScope, routes.user.requireAdmin, routes.mail.getStatus);
     router.post('/api/v1/mail/:domain/mail_from_validation', settingsScope, routes.user.requireAdmin, routes.mail.setMailFromValidation);
     router.post('/api/v1/mail/:domain/catch_all',  settingsScope, routes.user.requireAdmin, routes.mail.setCatchAllAddress);