encrypt-on-delivery mail stack

Your own mail server, where stored mail is unreadable — even to the server.

Everything Mailcow or Mail-in-a-Box gives you — SMTP, IMAP, spam filtering, virtual domains, quotas — plus one thing they don't: every message is PGP-encrypted the moment it arrives, before it ever touches disk.

Open the consoleDeployment steps
6
services
RFC 3156
PGP/MIME
0
private keys stored

The path a message takes

Plaintext lives only in memory, for milliseconds, inside the encrypt gateway.

  1. 01

    Postfix accepts

    SMTP on 25, authenticated submission on 587/465. Domains and mailboxes come from Postgres.

  2. 02

    Rspamd filters

    Spam scoring, DKIM signing and authentication results before anything is queued.

  3. 03

    Gateway encrypts

    Each message is wrapped as PGP/MIME using the recipient's public key, in memory.

  4. 04

    Dovecot stores

    Only ciphertext reaches the Maildir. IMAP clients decrypt locally with the private key.

Public keys only

The server never holds a private key, so it cannot read a single stored message. Zero-access by construction, not by policy.

One compose file

Postfix, Dovecot, Rspamd, Postgres, the encrypt gateway and the admin API come up together with docker compose up -d.

Full REST API

Domains, mailboxes, aliases, quotas, keys and delivery metadata — every console action is an authenticated API call.

Key hygiene built in

Uploaded keys are parsed and fingerprinted, private keys are rejected, and mailboxes without a key are flagged as unprotected.

Deploy it on any VPS

One script installs everything on a fresh Debian or Ubuntu server: mail delivery, encrypted storage, the admin console and webmail, all behind HTTPS on port 443. Then a guided setup page walks you through your admin account, your first domain and the DNS records to publish.

  • HTTPS certificates issued and renewed automatically, for the panel and for mail.
  • A, MX, SPF, DKIM, DMARC, PTR — generated per domain, with a copy button on every value.
  • Back up the database and the Maildir; the mail is already ciphertext.
mailserver
git clone <this-repo> encpost && cd encpost
sudo bash install.sh --hostname mail.example.com \
                     --email you@example.com

# then open https://mail.example.com/setup

What encryption at rest does not hide

Envelope metadata

Sender, recipient, timestamp and size stay readable — SMTP requires them.

Subject lines

Readable unless you enable subject encryption, which breaks subject search in most clients.

Mail in transit

Hop-to-hop TLS still depends on the other server, unless you encrypt to the recipient's key too.