Self-hosted organizational email

Problem

Teams that live on a public mailbox lose control of identity, retention, and where messages sit. Outages, policy changes, and per-seat cost become someone else's decision. Routing mail through a third party also makes internal alerts and app mail hard to audit.

A private mail platform fixes that only if it can actually deliver: accept mail, send it without landing in spam, keep mailboxes available, and sit behind TLS like any other production service.

System Design

This project is a self-hosted mail stack for an organization. A mail transfer agent sends and receives. Mailboxes stay on persistent storage. A reverse proxy terminates TLS for web access. Authentication and DNS (SPF, DKIM, DMARC) are part of the deploy, not an afterthought.

Configuration lives in environment variables. Deployment is repeatable. Logs and queues are visible so a stuck message is a metric, not a mystery.

Architecture Decisions

• Mail transfer and mailbox storage as separate roles
• TLS on submission and web access
• DNS authentication so outbound mail is trusted
• Persistent volumes for queues and mailboxes
• Reverse proxy in front of the web interface
• Scripts for deploy, health, queue inspection, and backup

Tradeoffs

• You own reputation, DNS, backups, and abuse handling
• Deliverability takes warmup and correct records — not just bringing the stack up
• More moving parts than a hosted mailbox
• A single-host setup is simple but is not multi-site mail HA

Production Behavior

Set the domain and DNS records, then deploy. Inbound mail lands in local mailboxes; outbound goes out signed. The proxy serves the web interface over HTTPS.

Watch the queue after cutover. Back up mailboxes on the same cadence as any other system of record. Built for teams that need organizational mail on their own network, not a rented inbox.