foxcpp/maddy

Features

• Modular Mail Server Assemblies - Assembles a complete email server by connecting small, single-purpose modules through a declarative configuration file.
• Declarative Module Assemblies - Assembles a complete mail server by connecting small modules through a declarative configuration file.
• Check Failure Quarantines - Marks a flagged message as quarantined so storage backends place it in a junk mailbox and remote delivery is refused.
• Check Failure Rejections - Rejects the message at connection time when a check module flags it as bad, preventing delivery without generating a bounce.
• Email and Messaging - Parses and generates email messages following RFC 2822, MIME, and internationalized header standards.
• SQL-Backed Message Stores - Stores IMAP indexes and message metadata in SQLite, PostgreSQL, or CockroachDB while keeping message bodies in a separate blob store.
• Message Body Storage - Stores message bodies in a file system directory, creating the directory if it does not exist.
• Mail Delivery Agents - Delivers accepted messages to the destination mail exchange server for the recipient's domain.
• SPF Verifications - Checks whether the connecting IP is authorized to send mail for the domain in the MAIL FROM address, then maps the result to a configurable action.
• Message Routing Pipelines - Processes each incoming message through a configurable pipeline of checks and delivery rules.
• Internationalized Email Handlers - Implements full Unicode support for email addresses, headers, and bodies per internationalization standards.
• IMAP Mailbox Managers - Provides remote mailbox access using IMAP4rev1 with IDLE, MOVE, and TLS extensions.
• Mail Servers - Ships a complete mail server that can be deployed inside a Docker container with mounted volumes.
• IMAP Services - Holds received messages in mailboxes and provides client access through the IMAP protocol.
• Outbound Mail Relays - Forwards messages from an external submission service to a dedicated SMTP endpoint for outbound delivery.
• Message Delivery Pipelines - Processes incoming messages through configurable pipelines of checks and delivery steps.
• SMTP Sending - Delivers outgoing messages to other mail servers using the SMTP protocol, acting as a Mail Transfer Agent.
• SMTP Transfers - Sends and receives email using the SMTP protocol with extensions for pipelining, authentication, and internationalization.
• SASL Implementations - Verifies user identities during connection using the Simple Authentication and Security Layer framework.
• SASL Delegation Architectures - Delegates user authentication to external services like Dovecot, LDAP, and PAM via SASL.
• IMAP Credential Delegations - Forwards authentication requests from the submission service to an external IMAP server using the SASL protocol, so users authenticate against the existing mail store.
• ACME Implementations - Automates TLS certificate lifecycle via the ACME protocol with DNS-01 challenge support.
• Certificate Renewal Managers - Automatically obtains and renews TLS certificates via the ACME protocol without manual intervention.
• Email Signing - Signs outgoing messages using DKIM with key selection based on SMTP envelope sender.
• DANE and MTA-STS Verifiers - Verifies recipient TLS certificates via DANE and enforces MTA-STS policies for secure mail delivery.
• Email Sender Authentication - Applies DKIM, SPF, DMARC, DANE, and MTA-STS checks to authenticate senders and prevent spoofing.
• Outgoing Email Authenticators - Applies DKIM, SPF, DMARC, DANE, and MTA-STS checks to messages to prevent spoofing and improve deliverability.
• External Authentication - Delegates user credential verification to Dovecot SASL, LDAP, PAM, SQL databases, or remote IMAP servers.
• TLS Certificate Management - Automatically fetches and renews TLS certificates from a CA using the ACME protocol.
• Global Default Configurations - Sets a default TLS certificate and cipher suite for all endpoints, with per-module override support.
• SMTP Reception - Accepts email messages through SMTP, LMTP, or Submission protocols, optionally verifying sender credentials before processing.
• Email - Applies DKIM, SPF, DMARC, DANE, and MTA-STS checks with configurable violation actions.
• Outbound Delivery Security Enforcers - Ranks each outbound connection by MX and TLS security levels and rejects delivery when the connection falls below the required policy.
• Automated Certificate Management - Automatically obtains and renews TLS certificates via the ACME protocol without manual intervention.
• Signature Verification Tools - Checks incoming messages for valid DKIM signatures to confirm sender domain and integrity.
• Inbound TLS Requirements - Checks that the source server connected over TLS and rejects messages from unencrypted connections.
• Inbound Configurations - Loads TLS certificates from files or ACME providers to secure incoming mail connections with optional SNI support.
• IMAP Connection Authentications - Requires an authentication module to verify user credentials before granting access to the mail store.
• Mailbox Account Allocations - Allocates local mailbox storage accounts so users can receive and store email on the server.
• Quarantine Rejections - Refuses to deliver messages that checks have marked as quarantined, preventing their transmission to remote servers.
• LMTP Message Receptions - Accepts incoming messages from an external SMTP server through a local LMTP socket for IMAP storage.
• Message Preprocessings - Validates and normalizes header fields (From, To, Cc, Bcc, Reply-To, Message-ID, Date) on incoming messages.
• Envelope Recipient Rewritings - Replaces the recipient address in the SMTP envelope using a table-defined mapping, supporting 1:N expansions for mailing lists.
• Header Injections from Commands - Prepends a valid RFC 5322 header produced by an external command to the message header.
• Mailbox Size Restrictions - Rejects new messages exceeding a configurable size limit to control storage consumption.
• SMTP Pipeline Command Executions - Runs a user-supplied command at a configurable stage of SMTP processing and uses its exit code to accept, reject, or quarantine the message.
• Email Authentication Record Publication - Creates MX, SPF, DKIM, and DMARC DNS records so other servers can deliver and verify mail.
• Sender Domain MX Validations - Checks that the domain in the MAIL FROM command has a valid MX record and quarantines messages from domains without one.
• Email Address Mapping Tables - Transforms email addresses through chainable file, SQL, and regex lookup modules.
• Address Mappings - Transforms recipient email addresses using a configurable table and normalization function before delivery.
• IMAP Flag Assignments - Runs a custom command during message delivery to set IMAP keywords and override the target folder based on command output.
• LMTP Delivery Integrations - Routes incoming messages to an external IMAP server's LMTP endpoint for local mailbox storage.
• Custom Delivery Logics - Applies user-defined code late in the delivery pipeline to change the destination IMAP folder and add flags.
• Multi-Domain Mailbox Isolations - Creates separate or shared authentication and storage accounts across multiple domains with independent or unified mailboxes.
• Unified Mailboxes - Maps multiple domain-specific email addresses to a single shared username for both authentication and IMAP storage, merging mailboxes.
• Rspamd Integrations - Contacts a rspamd server over HTTP to evaluate incoming messages and apply spam-filtering decisions.
• PAM Credential Validators - Validates user credentials against the system's Pluggable Authentication Modules (PAM) stack, commonly used for local system logins.
• Group-Based Access Controls - Requires that authenticated entities belong to a specified NetAuth group before granting service access.
• Outbound TLS Customizations - Adjusts TLS version ranges, cipher suites, and client authentication settings for outbound connections.
• Dovecot SASL Integrations - Verifies user credentials by delegating to an existing Dovecot server via SASL.
• Domainless Logins - Accepts usernames without a domain part during authentication and storage operations for convenience.
• Credential Managers - Manages password hashes and user credentials through a dedicated CLI command.
• CLI-Managed Credential Stores - Provides a CLI tool for managing user password hashes in mutable table modules.
• Policy Hosting - Hosts a policy file at a well-known HTTPS URL that tells compatible senders to always use authenticated TLS.
• Domain Ownership Verification - Proves domain control by placing a DNS record, enabling certificate issuance without exposing a public HTTP endpoint.
• Envelope Sender Rewritings - Replaces the sender address in the SMTP envelope using a table-defined mapping, supporting 1:N expansions for mailing lists.
• DMARC Policy Deference - Skips SPF enforcement when the sender domain has a DMARC record with a quarantine or reject policy, letting DMARC handle the final action.
• Email Spam Filtering - Integrates with the rspamd HTTP API to scan incoming messages for spam, replacing the need for a milter proxy.
• SASL Endpoint Exposures - Exposes a Dovecot SASL authentication endpoint so an external SMTP server can verify user credentials for message submission.
• Domain-Shared Credentials - Maps multiple domain-specific email addresses to a single shared username for authentication while keeping mailboxes separate.
• Multi-Domain Expansions - Appends one or more domains to a local part, expanding a single address into multiple email addresses across different domains.
• Remote LDAP Authentications - Verifies credentials by binding to a remote LDAP directory service using the provided username and password.
• Domain Mapping - Creates separate authentication and storage accounts for each domain, keeping users fully isolated.
• Local File Authentications - Checks usernames and passwords against a static file (e.g., passwd or shadow format) stored on the server.
• SQL Credential Verifications - Verifies credentials by querying a relational database table that stores usernames and hashed passwords.
• Table-Backed Password Verifiers - Looks up a password hash from a table module (file or SQL) to verify user credentials during login.
• Outbound TLS Configurations - Specifies TLS options for outgoing connections, including cipher suites and protocol versions.
• Multi-Provider Credential Verifications - Looks up usernames in a table then verifies passwords against one or more authentication providers.
• Remote IMAP Authentications - Validates a user's login by attempting to authenticate against a remote IMAP mailbox server.
• Exit Code Pipeline Mappings - Maps each exit code of an external command to a specific pipeline action such as reject, quarantine, or ignore.
• DNSBL Sender Reputation Checks - Queries one or more DNS-based blackhole lists using the connecting IP or hostname and rejects messages listed on any configured blocklist.
• Milter Protocol Connectors - Connects external software via the milter protocol to inspect or modify messages during SMTP delivery.
• Email - All-in-one email server.
• Email Servers - Composable, all-in-one mail server written in Go.
• Email Services - Modern, all-in-one mail server.
• Email Solutions - All-in-one mail server daemon.

Star history