A single node. Postfix owns the SMTP conversation, a content filter makes every policy decision, and three web applications sit behind nginx. Nothing in the mail path leaves the host.
Processes and ports
| Component | Listens on | Role |
|---|---|---|
Postfix smtpd | :25 (public) | Accepts inbound mail and relays outbound. |
| Content filter | Postfix pipe, max 10 concurrent | One process per message. Every filtering decision happens here. |
| Postfix reinjection | 127.0.0.1:10026 | Filtered mail re-enters here with the filter disabled — the loop breaker. |
| OpenDKIM | 127.0.0.1:8891 | Signs on the reinjection hop, after filtering. |
| nginx | :80, :443 | Terminates TLS; routes /, /admin and /api. |
| Admin console | 127.0.0.1:8001 | Configuration, quarantine, reporting, diagnostics. |
| Recipient portal | 127.0.0.1:8002 | Where external recipients read secure messages. |
| Send API | 127.0.0.1:8003 | Authenticated outbound submission for applications. |
| PostgreSQL | 127.0.0.1:5432 | Configuration, metadata, audit and mail log. |
| ClamAV | Unix socket | Anti-malware scanning, when enabled. |
Only 25, 80 and 443 are exposed. Everything else binds to loopback, so the web applications are reachable only through nginx and the database is not reachable off-host at all.
Throughput. The practical limit is the filter’s concurrency cap of 10 processes, since each message forks a Python interpreter. That is the knob to look at first under load, ahead of CPU or RAM.
Inbound: internet to your mail server
- Postfix accepts on :25. Connection-level rejects happen here — optional HELO and unknown-sender-domain checks, any Postfix-level blocklists, and always an anti-open-relay check so the gateway will only accept mail for domains you configured.
- Handed to the content filter as raw RFC822 with the envelope details.
- Direction is decided by recipient domain: any recipient in your configured domains makes the message inbound.
- Per-domain policy overlay. Domains can override most filtering settings independently.
- Anti-malware. ClamAV plus the attachment policy, which inspects one level into archives. If the scanner is unavailable the message is deferred, never delivered unscanned — Postfix retries it later.
- Greylisting, if enabled: first sighting of a sender triplet is temporarily rejected.
- Archive copy written encrypted, if eDiscovery journaling is on.
- Spam scoring. A weighted score across every enabled check — blocklists, SPF, DKIM alignment, content heuristics, DNSBL, phishing signals, the AI classifier, Bayesian filtering and DMARC. Over the threshold, the configured action applies: quarantine, tag the subject, or deliver anyway.
- Recipient verification, if enabled: confirm the address exists before accepting it.
- DLP runs whenever any recipient is external, in either direction.
- URL rewriting and the inbound footer applied, if enabled.
- Reinjected on 10026 and relayed to your mail server via a bracketed transport, so no MX lookup is done for your own domains.
Outbound: your mail server to the internet
The same path, with one difference at the policy step: the gateway evaluates your encryption rules, and on a match the message is not delivered as email at all.
- Your mail server relays to the gateway as a smart host.
- Filter runs; DLP applies to any external recipient.
- Encryption rules evaluated. Rules match on a named header or a subject regex — so a client add-in stamping a header, or a user typing a tag in the subject, both work.
- On a match, the message is protected — encrypted to the local store and replaced with a notification (see below). Evaluated per recipient.
- Otherwise reinjected, DKIM-signed, and delivered via MX or your smarthost.
No rules ship by default. The gateway does not guess what should be encrypted. Until you create at least one rule under Protection rules, outbound mail flows normally.
How a secure message actually works
There is no S/MIME, no PGP and no per-message password to communicate. When a rule matches:
- The entire raw message — headers, bodies and every attachment — is encrypted as a single blob and written to the local store with mode 0600.
- The recipient receives a plain notification email containing a link to your portal. No content, no attachment.
- Opening the link shows their masked address and offers to send a code. A 7-digit one-time code is emailed to the address stored on the message, never to one supplied by the visitor — so forwarding the link does not transfer access.
- Only the code’s hash is stored. Five wrong attempts burn it; each failure also counts toward an IP block. Resends are rate-limited.
- On success the message is decrypted for viewing, sanitised, and rendered in a sandboxed frame. Attachments decrypt individually on demand.
- Replies come back through the portal. A reply to an internal address is injected as normal mail; a reply to another external address becomes a new secure message. Reply attachments are re-scanned, because the injection path bypasses the filter.
| Default | Value |
|---|---|
| One-time code | 7 digits, 15 minutes, 5 attempts, 60-second resend cooldown |
| Message readable for | 14 days from delivery |
| Unlocked session | 30 minutes, per message |
| Reply attachments | Up to 10 files |
After 14 days the link returns an expired response. Rows and ciphertext are deleted later by the retention job — 30 days by default — so a message becomes unreadable before it is erased.
Scheduled work
Systemd timers, all adjustable:
| Job | Schedule | Purpose |
|---|---|---|
| System sampler | Every 60s | CPU, memory, disk and network series for the dashboard. |
| Health check | Every 5 min | Queue depth, disk, certificate expiry, an active pipeline probe; alerts on change. |
| Update check | Hourly, jittered | Signature-verified version check. Auto-apply off by default. |
| AI advisor | Hourly, jittered | Honours its own configured period. |
| Backup | 02:30 | Database, encrypted store, and secrets when a passphrase is set. |
| DMARC reports | 03:00 | Sends your aggregate reports. |
| Maintenance | 03:30 | Applies retention and prunes metrics. |
| Quarantine digest | 07:00 | Per-user held-mail summary with self-service release. |
| Admin report | 07:30 | Scheduled summary to your operations mailbox. |
Failure behaviour
Worth knowing precisely, because it is where mail security products usually disappoint:
- Any unhandled filter error defers the message. Postfix keeps it queued and retries. Mail is not lost to a filter bug.
- Anti-malware fails closed. ClamAV unreachable means deferred, never delivered unscanned.
- Reputation and AI checks fail open. SPF, DKIM, DNSBL, Safe Browsing and the AI classifier all yield “no opinion” on timeout, so a third-party outage cannot stop your mail.
- DMARC enforcement quarantines, never drops. A false positive is always recoverable.