Understand the boundaries.
Useful security starts with knowing what the implementation does, what you configure and what is still taking shape.
Evaluate delivery, authentication, access controls and recovery in your own environment. A feature list is not a security certification or a guarantee of deliverability.
Encrypted mail connections
SMTP and IMAP support STARTTLS and implicit TLS. The project includes ACME / Let’s Encrypt certificate provisioning and renewal for mail TLS. Supply valid hostnames, DNS and certificate challenge access as required by your configuration.
Public webmail and REST traffic need a TLS-terminating HTTPS reverse proxy. The built-in web listener does not automatically become HTTPS when configured to use port 443.
Account access
The implementation includes bcrypt password hashing, JWT-based API authentication, TOTP two-factor support and optional LDAP / Active Directory integration. Per-IP and per-user rate limiting is available for relevant services.
Keep admin access restricted, protect signing keys and integration tokens, and review each service’s bind address. MCP defaults to loopback; external binding requires an explicit token and privileged operations require an admin token.
Several checks, one message path
SPF, DKIM, DMARC and ARC handle email authentication signals. RBL checks, Bayesian and heuristic filters, greylisting and configurable thresholds contribute to the spam decision. Their results depend on your configuration and environment.
ClamAV is an optional external integration. Installing the core binary does not install or operate an antivirus daemon for you.
Know the current limits
- The project is single-node; shared-data replication and high availability are not implemented.
- S/MIME and OpenPGP message verification are unsupported. DANE is advisory, not enforced.
- MCP queue tools are placeholders; use the admin REST API for implemented queue operations.
- Contacts UI is a stub; admin Settings and account Profile have read-only limitations.
- CalDAV, CardDAV, JMAP and POP3 are optional and disabled by default; review their current scope before enabling them.
- Configuration changes generally need a restart. SIGHUP only rechecks manual TLS certificates.
See the current security scope and hardening guide. Report issues through the project’s published security process.
Open source, with a clear license
The repository’s root LICENSE specifies AGPL-3.0-or-later. Older README text and promotional artwork referring to MIT are inconsistent with this file. Review the authoritative license when distributing or modifying the software.
Contributions are welcome through the official contribution guide. Use reproducible issue reports and run the project’s applicable checks with your changes.