14 ms·

Mox – modern, secure, all-in-one email server

• durakot 2y ago
  It's cool to see some new modern all-in-one email solutions. Stalwart is another good one. Would be even cooler to see this lead to a bit of a resurgence of small and self-hosted email providers.
  • ehnto 2y ago
    I hope it does. We have to get through the challenging issue of convincing big tech companies that our small email servers are not spam however.
    • durakot 2y ago
      I've self-hosted email on and off since the mid 2000s and my impression is that with the widespread adoption of DKIM/DMARC, the large providers have toned down the spam-by-default treatment of small/unknown email servers. Even Microsoft a bit, though you still have to get your IP whitelisted to send to outlook.com addresses usually.
      • ehnto 2y ago
        That's really great to hear, I haven't self hosted since maybe 2015. I must admit I assumed things would surely have gotten worse, not better.
        • durakot 2y ago
          Definitely got worse since 2015 before seeming to get better the last year or two. At least with Gmail. So many variables though, so this is more an impression based on my own experience.
      • VladVladikoff 2y ago
        Microsoft is absolutely hell to deal with. Especially if you are hosted on Linode. They frequently ban entire linode subnets. I’ve had to resort to routing all send mail via Amazon AWS SES just because of Microsoft’s IP range bans. It’s not what I’m doing, but my neighbours.
        • durakot 2y ago
          Yeah they are definitely the worst of the bunch. But that's unsurprising I guess.
        • velcrovan 2y ago
          It's funny because throughout Q1 2024 a huge range of Microsoft's own IP addresses were blacklisted by Spamcop and other blacklist providers spam/phishing attacks coming from outlook.com addresses. (Google "EX703958" (MS's issue#) for some fun reading.) They (and their enterprise customers) have been on the receiving end of the same thing they do to others.
        • devsda 2y ago
          Allegedly, Microsoft subscribes to random spam checklists like UCEProtect. uceprotect bans entire subnets & ASNs if just one IP is suspected of sending spam.Apparently, you can pay to get your IP whitelisted for some time but it will be back on the list again. Its probably a scam/shakedown operation. As these lists discourage self-hosting and benefit large email providers, they take their own time for fixing these issues.
      • goku12 2y ago
        That's perhaps because you have been self-hosting that long. One of the advises given to new self-hosters these days is to start sending mail to your your friends' email accounts that are hosted by the bigtech. Then you have to contact each one and ask them to mark it as not-spam, so that some day your mails will go to their inboxes, rather than the spam folder. Honestly, I don't think that DKIM/DMARC has made the situation any better. In fact, spamassassin and rspamd often seems to work better than their spam filters in identifying actual spam.
        • zimpenfish 2y ago
          > Then you have to contact each one and ask them to mark it as not-spam That presumes the email is accepted into the spam folder rather than being rejected outright at SMTP time.
          • goku12 2y ago
            You're right. I don't know the situation now, but Outlook used to behave exactly like this.
      • petee 2y ago
        I haven't tried sending to Outlook, but so far I'm getting through Google with just a strict SPF and a DNSSEC domain. Very low volume, to the point I assume reputation isn't being tracked. Just an observation
    • jwr 2y ago
      This doesn't seem to be a problem anymore. What is a problem, though, is big tech companies spamming us incessantly and doing almost nothing to prevent that. I get 10-20 spam E-mails a day from AWS, Google and Microsoft. Forwarding spam to their abuse@ contacts doesn't seem to do anything. And I can't block them, like I would a smaller spammer.
      • VladVladikoff 2y ago
        Haha the best part is when the same Gmail or outlook address spams you again two weeks after reporting that very same address to abuse@gmail/outlook.
        • n_ary 2y ago
          Outlook is extra bad. It is apparently possible to put your email(to/recipient) in BCC, so if you have aliases, it is impossible to tell, which one was leaked and being abused, as to is marked as “undisclosed recipients”. There is no mass domain/pattern block rules, so if I block “spammer.1@hotmail.com”, then next day it arrives from “spammer.01@hotmail.com”, then blocking that, next day it arrives from “spammer.001@hotmail.com”. Outlook is actively hostile to blocking spams yet happy to quickly block small self-hosted operators.
        • jwr 2y ago
          With AWS I reported 3-4 spams from a certain company every day for 3 weeks. Nothing changed. They just ignore the reports.
  • Avamander 2y ago
    Stalwart does seem much more modern and feature-complete however.
  • leptons 2y ago
    Self-hosting email is a fool's errand. I used to do it. I'll never do it again. It requires way too much specific knowledge about how the entire email system works. You have to really want to learn everything about running an email server and everything about email to be successful, and even then your ISP could get in the way, as well as all kinds of spam blocker services that you have to deal with to get your special email server unblocked. It was a nightmare, and it's honestly worth paying a few bucks a month for someone else to deal with that. I have a ton of other way more important things to do with my time.
    • deleted 2y ago
      [deleted]
    • dwedge 2y ago
      Email hosting is absolutely the lowest maintenance of everything I host. For anyone else reading this, if you follow 'mox quickstart' it will help you set up your DNS correctly so you don't have the above experience.
      • leptons 2y ago
        Congratulations for not hosting anything interesting, I guess? My self-hosted VPN is the lowest maintenance thing ever - it just runs, and I never have to touch it. I host quite a bit of stuff, but email was daunting. Every week it was some new fresh hell. Spam blocking lists were the worst of it, and no I wasn't spamming anyone.
  • deleted 2y ago
    [deleted]
  • dyzdyz010 2y ago
    Stalwart isn't really an all-in-one solution, it doesn't have webmail functionalities, just a backend.
    • throawayonthe 2y ago
      the FAQ claims it does have a web interface; is it not really functional, or something else? never used it myself https://stalw.art/docs/faq#does-it-have-a-web-interface https://stalw.art/docs/faq#does-it-have-a-web-interface
      • AAAAaccountAAAA 2y ago
        That's an admin interface, to configure the server. Webmail is something that one uses to read the mails.
• johntitorjr 2y ago
  If I spun this up and attached it to my domain, would my emails be received by gmail/outlook/etc? I'm pretty happy with forwardemail.net as a mail server, I selfhost snappymail to access it through a web browser. Not sure I want to take the step to selfhosting an email server, but I love the idea of cutting that external dependency.
  • durakot 2y ago
    Yes, but it depends heavily on whether your mail server has a clean IP with no spam history, the reputation of the IP range it belongs to, whether you've correctly set up DKIM/SPF records, etc. And you might have to get MS to whitelist your IP before you can send to outlook.com address, you'll only find out in your email logs whether that's the cast when you try the first time.
  • kazinator 2y ago
    You will almost certainly be able to continue to use forwardemail.net as your SMTP forwarding host for sending traffic. That means that you do either one of two things: - keep using forwardemail.net SMTP credentials in all your e-mail clients, such as snappy. Only point those clients to your own server for IMAP4 access (accessing the mailboxes where mail is flowing into your own server). - or else, point SMTP to your own server, and configure your SMTP server to use forwardemail.net as the next host. There are some advantages in that you have your own SMTP endpoint that you can use with multiple devices. In my case, my phone can talk to my own SMTP server for sending mail, and my SMTP server talks to my residential ISP's SMTP server. My phone cannot talk directly to my residential ISP server, because it's not inside their network; it's on an unrelated mobile network. So my SMTP server acts as mail forwarding proxy for the phone. - Sine you keep using forwardemail.net for sending, your reachability is not impacted. Sending SMTP through forwardemail.net is covered in their FAQ. It looks like they have a few configuration hoops to jump through: https://forwardemail.net/en/faq#do-you-support-sending-email-with-smtp https://forwardemail.net/en/faq#do-you-support-sending-email... I'm guessing you know about this because you must be using that with your snappy setup. What catches my eye is that they have some configuration bits where you declare your custom domain. That's not always necessary. For instance, in my setup, my ISP knows nothing about me and my domain. I just connect to their SMTP server, and use whatever From: header I want in my e-mails. The SMTP envelope address is one assigned by the ISP. I also noticed the bit at the bottom of that FAQ about their "manual review process on a per-domain basis for outbound SMTP approval" which supposedly takes 24 hours.
• linsomniac 2y ago
  With that top screen shot, I'm surprised that it does't have UUCP support.
  • mrweasel 2y ago
    I think it looks amazing. No non-sense, clear labeling on buttons and nice colours.
    • linsomniac 2y ago
      The first screen shot is an e-mail from Ian Lance Taylor, the author of, arguably, the best UUCP implementation, and how I sent/received most of my e-mail up until 2010. It was really, really good at dealing with spotty wireless connections like CDPD and spotty early cellular hotspots. All my company's e-mail would come into an SMTP server, and then the last mile was UUCP to our individual laptops. Story time: Back in maybe '93, I had a UUCP connection to a provider in Colorado. I was calling in from Nebraska (I had moved out there temporarily, but it had always been a long distance call). One day the e-mail stopped flowing. After a bunch of debugging I found that it would connect, and then sit there waiting for data packets from the remote end. I got ahold of the provider and the issue was they were using the SunOS UUCP, which stored all the files for all feeds in a single directory, and some of their users didn't call in regularly, some I get the impression were getting e-mail and not calling in anymore. Eventually this directory filled up to the point where the OS couldn't scan it within the UUCP timeout. They ended up throwing hardware at the problem, but I suggested that they switch to taylor-uucp. Taylor stored the queues in a per-endpoint set of directories, so you didn't run into the large directory problem unless your UUCP endpoint was the offending one. However the provider replied that "tayloruucp doesn't work well with larger providers." So I asked Ian Lance Taylor about that, and he replied "That's news to [one of the largest national, probably international UUCP providers]".
• jwr 2y ago
  So happy to see that. Hopefully more people will run their own E-mail instead of being slaves to the large adtech "free" e-mail providers. We need more balance on the Internet.
  • kazinator 2y ago
    You can't run your own e-mail, or not entirely. It's practically impossible to send SMTP from your own IP address. For sending SMTP, you need to go through a smarthost that has reputation. If your ISP provides you with an e-mail setup that you can use with a conventional mail client where you enter IMAP4 and SMTP credentials, chances are you can use that for SMTP sending. I.e. from the perspective of sending mail, your ISP can't tell that you're a server; it thinks it's just Outlook or Thunderbird connecting to it. Receiving mail is no problem; your ISP just must not be blocking port 25. It's handy to give yourself mobile access. When I send mail from my phone, it connects to port 537 of my own mail server which provides authenticated SMTP over TLS. It forwards to the aforementioned ISP. (I can't connect directly to my home ISP's SMTP server from my phone because the phone is on a mobile network unrelated to that ISP; the ISP's SMTP forwarding servers are firewalled so only the subscriber addresses can talk to them.)
    • Avamander 2y ago
      Using an ISP's SMTP is an incredibly obsolete and problematic concept. Poorly authenticated with even worse deliverability. It was a bad idea even 10 years ago and it's just horrid right now. Use your email provider's SMTP, even if it's you yourself.
    • khimaros 2y ago
      hetzner allows outbound smtp by request. the process is relatively painless and quick.
      • jks 2y ago
        Yes, but the process of getting Gmail, Outlook etc to receive your emails and put them in recipients' inboxes is far from painless or quick. An IP address with a clean history and SPF/DKIM/DMARC are table stakes, but then you get to play the "my emails are randomly dropped today while everything looked fine yesterday" game.
• VladVladikoff 2y ago
  I have some questions for the creator of this software if they happen to be paying attention to this thread. I have been running a small scale email server for about 10 different related business domains. Currently we use iRedMail. 1) Does the webmail client support 2FA? 2) Is it possible to do 2FA in thunderbird? 3) Can I make custom rules for BEC attacks (ideally I want to define “FirstName LastName” => email@domain.com whitelists using regex patterns. We get a LOT of very targeted BEC attacks and we have found this is the best way to handle it. We have it very locked down now. Yes we also do employee education on what to look for but this also helps. 4) does the webmail client do banners like “this sender is outside of your org” or “you have never received an email from this sender beige” etc. Thanks!
  • yamrzou 2y ago
    Apparently, it doesn't support 2FA (yet). From https://discuss.privacyguides.net/t/mox-modern-full-featured-open-source-secure-mail-server-for-low-maintenance-self-hosted-email/19516/3 https://discuss.privacyguides.net/t/mox-modern-full-featured...: > Another is 2FA. It would be relatively easy to implement in the web interfaces, but not with SMTP (submission) and IMAP. Most clients can at most do cram-md5 for authentication mechanism (old). I don’t know any clients doing the safer scram-sha-256-plus properly (with mutual verification and TLS channel binding, mox implements it). Interested in hearing what the thoughts are on these topics.
  • mjl- 2y ago
    1. no 2fa in the webmail yet. work is currently underway at the ietf for standardizing chained SASL (auth) mechanisms, and passkeys. i want to look at implementing passkeys already for the web interfaces, but there is much more on the todo-list... 2. i as shown by yamrzou, i don't think so. SASL auth really just uses 1 auth mechanism at the moment. i think there is also standardiziation work underway for password+totp sasl authentication. but clients (like thunderbird) would still have to implement it before it's useful. there may be a trick to get 2fa-like authentication now, using both TLS client cert authentication (mox supports this based on public key identification, no other properties of certs) and a IMAP/SMTP-level SASL authentication. 3. no, but this is interesting. what kind of rules would you set? rules to match specific message headers/content that identify a message a phishing and reject it? for when attackers send the same message to many employees? do you need to remove messages from their inboxes after it has been delivered (assuming all employees would get the email at around the same time)? 4. no, but i've considered adding it. it should be very simple to add. and it's much better than mail servers modifying the message content to add messages like that.
• m00dy 2y ago
  It claims to be modern, yet the landing page looks outdated.
  • velcrovan 2y ago
    It's an SMTP server, not a web design app.
  • marssaxman 2y ago
    You say "outdated", I see "no-nonsense". It's clearly organized and all the information is right there where you want it; what's to complain about?
    • m00dy 2y ago
      Dude, we're living in the LLM era. If you're going in there manually searching for what you need, let me know which side you're on, because I want no part of it. That’s the losing side.
  • filchermcurr 2y ago
    I, for one, appreciate a simple design. "Modern" tends to end up being bloated and slow.
  • brokegrammer 2y ago
    It's one of the best landing pages I've seen in a while because it explains clearly what the software does, contains a video demo, and easy navigation to explore more. Basically, no BS.
  • mrweasel 2y ago
    > yet the landing page looks outdated. The current way of thinking is "It looks outdated", then the page is updated to look "modern" and that normally entails removing all relevant bits of information. I was going to attempt to find the Microsoft Exchange landing page, to show you what a modern landing page for a mail server looks like, and how utterly useless that is. Sadly the modernity has hit Microsoft hard and you can now only find the page for hosted Exchange/Microsoft 365 (https://www.microsoft.com/en-us/microsoft-365/exchange/email https://www.microsoft.com/en-us/microsoft-365/exchange/email). Granted the page looks more inline with modern webdesign and it fucking pointless, there's not one bit of useful information.
• tekknolagi 2y ago
  Can I use this instead as a frontend for an existing server? UI is perfect for me but I don't want to fully self host anything but the UI.
  • mjl- 2y ago
    No, that won't work. The webmail uses a simple custom protocol. Perhaps someone can rewrite it using JMAP in the future...
    • phoronixrly 2y ago
      JMAP seems opinionated and somewhat limiting as an API, migrating to it from a more featureful/ergonomic API might be a pain.
      • Mailtemi 2y ago
        What do you mean by JMAP is 'limiting as an API'? It actually lifts the IMAP protocol to be used by web apps easily.
• dtagames 2y ago
  Don't run your own mail server. You'll be attacked and get blacklisted and won't even know that it happened or why until you find out none of your emails to anyone get through. Securing a mail server is full time plus job. Proton is great and free with their domain and cheap with yours.
  • dtagames 2y ago
    I almost forgot... You'll also be receiving all the spam that the big providers filter for you, and that's a lot.
    • einr 2y ago
      This is not very hard to fix. Automatically downloading and applying public IP reputation blocklists cuts down on this by like 95%. The rest you can catch pretty trivially either with server-side filtering or just filter in the client. I do bad-IP filtering, but not spamassassin/rspamd. The client-side filtering in Mail.app kills nearly 100% of the few spam messages that get through.
  • hello_computer 2y ago
    Not true. I’ve run my own server for over a decade, which has presented far fewer problems than gmail. The ability to: easily create redirects & distribution lists, back up all of my inboxes in seconds with a single rsync command, pre-filter messages with external programs, & actually see the SMTP logs and packets in real-time are game changers.
  • muppetman 2y ago
    This isn't true. Almost all MTA have quite sane defaults these days. Yes it's not a simple walk in the park. I mean if you have 5000 users behind you then yes, what you say can be true, one compromised user can flood you etc. But as a "I have a small domain I host my own emails" I don't agree with your comment.
  • johnklos 2y ago
    Don't tell me what to do or what not to do, and especially don't tell me using provable lies and falsehoods.
• linwangg 2y ago
  Mox is written in Go. What advantages does this provide in terms of performance and security compared to traditional email servers, which are often written in C?
  • slasaus 2y ago
    No buffer overflows, no user-after-free and no double free issues. There is a garbage collector which stops the world here and there to cleanup, but for anything that is not constantly busy, like a small mail server, this is not noticeable.
• thinknchill 2y ago
  How does integrating all modern email protocols into a single application like Mox impact performance and security compared to using multiple separate components?
  • mjl- 2y ago
    From a security perspective, it is better to have separate & isolated processes (but written in modern languages that provide safety). Mox is currently a single process handling all connections, including deliveries over smtp, imap connections, and webmail and other http requests, which isn't great. User connections should probably be in a separate process. I'm not too afraid of the mox process being taken over (by a bug being abused, I don't think that's easy/common in software written in Go), but of course it will be a good line of defense against that. Resource limit enforcement of separate processes would perhaps be even nicer to get. I haven't gotten around to really designing privilege separation, but I'm forseeing some complications around handling http requests (of the webmail, pass each request on to the user process? Have to figure out how to do that with the http library), and message database access (the database files can only be open by a single process, need to do quite some back and forth to the user process in various places). For performance, I imagine it only helps to have an integrated server. Performance isn't really top of mind, I don't think mail servers are commonly highly loaded, at least not for the smallish scale servers. Btw, mox does not require a lot of resource (eg RAM) to run.
    • mjl- 2y ago
      > multiple separate components Btw, I don't think it's better to have separate _components_ as in separate software packages. Integrating this functionality into one software package prevents all kinds of complexity that would otherwise arise in the integration points. Integrated software also allows for new/user-friendlier functionality.
• qwertox 2y ago
  From the FAQ How do I configure a second mox instance as a backup MX? Unfortunately, mox does not yet provide an option for that. Mox does spam filtering based on reputation of received messages. It will take a good amount of work to share that information with a backup MX. Without that information, spammers could use a backup MX to get their spam accepted.
  • muppetman 2y ago
    These days a backup MX seems pretty pointless, no? If your mailserver is down, almost every mail platform out there with a message for you will store and retry later.
    • stonogo 2y ago
      backup MX systems are useful, but the above faq is ... naive. it's fairly simple to deploy a backup mx that does not accept mail unless the higher-priority mxes fail a health check.
      • mjl- 2y ago
        Seems reasonable. I have been thinking about schemes for backup mx'es. When the primary is online, the backup would just forward the smtp connections to the primary directly. The backup mx only has to do their own work when the primary is down. I was/am concerned about the backup mx accepting spam that you don't really want to bounce later on. But that should be an exception. I am also thinking about synchronizing all the data to another machine. It would allow a manual failover procedure. And it's nice to have another machine (IP) for outgoing email in case the primary IP gets on a block list. But this is all future work.
        • stonogo 2y ago
          the backup mx shouldn't have any special delivery privileges. when the primary mx comes back online, the backup should deliver to that rather than trying to deliver anything itself. this allows those spam checks which will still work to benefit from the normal delivery path. you can have several hosts with the same MX priority, and only spin up actual service when necessary. given modern health check tools and raft-consensus filesystems, it's very possible to build a robuse mail network on the cheap.
• brongondwana 2y ago
  Always interesting to see another implementation of IMAP4! Congrats.
  • mjl- 2y ago
    Hi Bron! Thanks, JMAP will come at some point too! (: Someone has already been working on JMAP support in mox. I'm currently in a refactor of the storage layer, keeping history of (deleted) mailboxes too. Should address storage requirements for JMAP.
    • brongondwana 2y ago
      Fantastic :) Great to hear. I really do hope to find some time to read through the code, I haven't written any Go, so it'll be a slog to understand everything, but reading code is good for you. That definitely is an extract challenge with JMAP, keeping enough tombstone information to accurately calculate the `destroyed` ids.
• calvinmorrison 2y ago
  does this support JMAP yet
• cvhc 2y ago
  I've been using maddy. It seems this has more features (like web interface, reputation tracking etc).
• canadiantim 2y ago
  how does it compare to migadu?
  • mrweasel 2y ago
    Migadu is a hosted service, this is the software to run your own email server... So I probably wouldn't compare the two.
• deleted 2y ago
  [deleted]
• ptman 2y ago
  Has someone compared this to other modern alternatives? Stalwart (open core), chasquid, maddy, ...?
  • ValdikSS 2y ago
    I've compared iRedMail, Mail-in-a-box, Mailcow, Modoboa, in 2021, if that helps (its in Russian) https://www.linux.org.ru/forum/general/16654099?cid=16658164 https://www.linux.org.ru/forum/general/16654099?cid=16658164
    • ptman 2y ago
      I'm not really interested in these setups that combine postfix, dovecot, opendkim etc. Those aren't what I consider modern all-in-one email servers.
  • brokegrammer 2y ago
    Stalwart seems to be Rusty, while this one is Gooey.
  • phoronixrly 2y ago
    Stalwart seems to be more ahead feature-wise. As a Stalwart user I will definitely keep an eye on this project. Just a couple of missing features that are a dealbreaker. One of them is also absent in Stalwart - aliases to external accounts.
  • donio 2y ago
    Haven't used Mox yet but Chasquid is great if you want something that's focused on being a streamlined modern MTA rather than "all-in-one". So kind of the opposite of the Mox approach. I like Chasquid for its straightforward codebase and the hook system that you can use to customize it further.
• rsync 2y ago
  I'm very happy to see this as I have been advocating for something like this for quite a while: a single setup and configuration that handles SPF, DKIM, DMARC all together. I understand, and appreciate, the modular philosophy behind OpenSMTPD, etc., but in practice it is quite frustrating and difficult to piece it all together - especially if you add rspamd, etc. Speaking of which, how is spam handled ? I see this in the FAQ: "Mox does spam filtering based on reputation of received messages." ... but it is not further elaborated. Also: I assume that the web service can be fully disabled and Mox can be run with no httpd but that is also not specifically called out ... can it ?
  • mjl- 2y ago
    There is some more information about spam filtering at the features page: https://www.xmox.nl/features/#hdr-junk-filtering https://www.xmox.nl/features/#hdr-junk-filtering I'm very happy with how the filtering works for me. Most email gets classified because of being a known sender. The first-time senders will go through the bayesian classifier, which keeps most spam out. For me, 1 spam message gets through every 2 days. If ham is incorrectly rejected as spam, the sender will hear about it, because mox will keep soft-rejecting the email, eventually resulting in a bounce. > I assume that the web service can be fully disabled and Mox can be run with no httpd but that is also not specifically called out ... can it ? You can run without the web interfaces. I think you can set it up without a public web server, but the admin interfaces are pretty convenient (though still spartan!), you could keep those internal. The webserver is needed for ACME, for MTA-STS, and for autoconfig. Btw, mox can also serve static files and do reverse proxying. The mox website is hosted by mox. I added webserver functionality (relatively tiny functionality/code compared with the email code!) so people wouldn't have to run another webserver, which greatly complicates the setup (with reverse proxying).
• reassess_blind 2y ago
  I like old school interfaces as much as the next nostalgic hackernews reader, but nothing about this looks “modern”.
  • m00dy 2y ago
    oh man, I wrote the same thing down below and then got so many down votes.
    • cwillu 2y ago
      Nattering on about llms didn't do you any favours.
  • abrookewood 2y ago
    They are referring to the start date (2021), language (Go) and feature set (SPF, DKIM, DMARC, MTA-STS, DANE and DNSSEC etc) rather than the design. Presumably you could use it for email delivery and skip the web mail piece altogether.
  • mjl- 2y ago
    The looks match the intended audience. (: I'm focusing on functionality/protocol support now. User/admin-friendliness and making it more attractive will come later. Mox will become irresistible to the masses then!
    • benhurmarcel 2y ago
      > The looks match the intended audience I thought it looked refreshing. Efficient, light, and no-nonsense. So you're right, it does match the intended audience.
• QuadrupleA 2y ago
  Wow... having just gone through a 20+ hour byzantine nightmare of setting up postfix & dovecot (that's on top of an already deep understanding of SMTP, DKIM, SPF, DMARC, SASL, etc.) and now struggling through an even more kafkaesque nightmare of rspamd (with its 3 different programming languages needed to understand its 92+ configuration files, which you can't modify by the way, you have to add your own "override" and "merge" config files on top of that mess) for the simple purpose of getting it to DKIM-sign my stupid outgoing messages the way all the big mail systems want... I wish I had seen mox earlier! Not sure its quality, but battling with postfix & dovecot's 20+ years of legacy cruft, I felt compelled many times to just throw them aside and build something like this on first principles - simple single binary mail server with modern protocol support, sans all the archaic UNIX-account timesharing-era sendmail bullshit that still lives on in the mainstays. Going to have a look at this one, despite now having moderately deep postfix & dovecot knowledge.
  • WhyNotHugo 2y ago
    I’ll never understand why postfix is so popular given how hated it is. OpenSMTPd has worked wonders for many years and in much easier to set up.
    • tmn007 2y ago
      if you started with sendmail (and sendmail.cf) then postfix was alright
      • n3storm 2y ago
        That's it, also Qmail was a nightmare (still is?) Perspective most of times is everything.
        • mrweasel 2y ago
          Oh I miss qmail, felt much easier to deal with than the alternatives.
    • defanor 2y ago
• floren 2y ago
  I appreciate the Plan 9 colors in the webmail UI.
  • mjl- 2y ago
    Most of mox is written with acme (also some vim)!
• alessioalex 2y ago
  Enjoy the presentation of Mox at Golang Rotterdam: https://youtu.be/KiDP_JoomOY?si=CyiUEgc8J5WfNZ5R https://youtu.be/KiDP_JoomOY?si=CyiUEgc8J5WfNZ5R
• glub103011 2y ago
  I'm not sure whether to use stalwart or mox
• xenophonf 2y ago
  That webmail screenshot made me realize how much I desperately miss threaded mail/news readers. <3 I should figure out how to make Roundcube do that.
• dcreater 2y ago
  Sad that the documentation isn't very friendly. Is this a replacement for Gmail? Can i use it with Thunderbird? Is it going to
  • nichos 2y ago
    It says right on the homepage it supports IMAP, so yes, you can use Thunderbird.
  • n3storm 2y ago
    You should investigate Gmail do not fully implement IMAP standard so any attempts to migrate from it will need some concessions to be made.
• mendelmaleh 2y ago
  Set it up in mid 2023, still running good! Getting it going was fun, staying on top and maintaining it isn't really...
  • mjl- 2y ago
    I'm hoping to make this easier in the future, more often automatically taking care of updates. In the past, you've had to run a command/script here or there to fix up date, but that should all be done automatically. My talk at FOSDEM was about this for a good part, https://fosdem.org/2025/schedule/event/fosdem-2025-5364-mox-and-simplifying-mail-server-setup-management/ https://fosdem.org/2025/schedule/event/fosdem-2025-5364-mox-.... If you have suggestions on how to make it less choreful to maintain, I'm interested in hearing it! Also if you had specific issues about maintenance/updates.
    • reidrac 2y ago
      Thank you, this is essential! Reading mox FAQ, it looks close enough to the ideal: https://www.xmox.nl/faq/#hdr-how-do-i-stay-up-to-date https://www.xmox.nl/faq/#hdr-how-do-i-stay-up-to-date I'm currently running a more classic setup with postfix and dovecot, because the updates and security fixes are managed by Debian. Once things are configured, I don't need to do anything using unattended upgrades (other than upgrade Debian itself when the LTS version goes out of support, that is!). At this point it is easier for me to not touch what I have, but in my next mail server I will consider mox!
      • mjl- 2y ago
        > because the updates and security fixes are managed by Debian. Once things are configured, I don't need to do anything using unattended upgrades This is a good point. It would be great to have mox packaged in more distributions. I spoke with a package maintainer about this. They understandably need to be able to upgrade unattended from old versions to a new version. In the past year, admins have had to run an upgrade command here and there (e.g. to reparse all the messages after the parsing code changed). I hope to make all this more automatic this year. That should make it more appealing for packagers (and for all non-distro-using admins too!). I think a new debian LTS release will be coming up soonish, we probably won't make that.
• quesomaster9000 2y ago
  On a side note, how long until we realize the current incantation of the pile of hacks upon hacks that is SMTP is fundamentally flawed and widely adopt something that has cryptography, authenticity and transport-level security built-in from the start? Oh wait, yes, that'll never happen.
• yazinsai 2y ago
  I used mailinabox[1] for years before finally biting the bullet and switching everything over to a hosted email platform. Hosting your own email servers sounds good, until: - Gmail and MS fling your emails in junk, despite ranking 10/10 on mailtester.net - You have to search for old emails through RoundCube's byzantine UI (and eventually giving up) [1] https://mailinabox.email/ https://mailinabox.email/
• apexalpha 2y ago
  Wow this looks great! Email was such a hassle a few years ago that I kind of just gave up on hosting it myself. Definitely trying this!
• chmike 2y ago
  How does mox compare to maddy, another Go all in one mail server ? Does mox support antivirus addition ? Didn't see that in the docs but I may have skipped that section.
  • preisschild 2y ago
    https://github.com/mjl-/mox/issues/1 https://github.com/mjl-/mox/issues/1
  • mjl- 2y ago
    > Does mox support antivirus addition No, not currently possible. I think it needs milter-like functionality in the smtp server. Would be good to have eventually.
• buserror 2y ago
  Funny that, I was looking recently for a small, local smtp server to get notifications from my printer and other stuff and... there isn't. All you get are the ginormous ones with decades of crud attached. So I ended up writing my own of course; no need for all the fancy features, just PLEASE let me receive email over SMTP and deliver them locally with 'dma'. Pfew.
• Tepix 2y ago
  Sounds interesting. I didn't find anything about sub-addressing in the features list. Is it a supported feature? Also, with a version number starting with 0.0. I'm left wondering if Mox is already stable enough to be entrusted with my precious email. Other options i'm considering are mailcow running in docker.
  • mjl- 2y ago
    > I didn't find anything about sub-addressing in the features list. Is it a supported feature? Yes, assuming you mean addresses like user+<anything>@domain. The "+" is configured by default when you add a new domain. See https://www.xmox.nl/config/#cfg-domains-conf-Domains-x-LocalpartCatchallSeparator https://www.xmox.nl/config/#cfg-domains-conf-Domains-x-Local.... > Also, with a version number starting with 0.0. I'm left wondering if Mox is already stable enough to be entrusted with my precious email. It's been suggested to just increase the version number since it's more stable than a 0.0.X might suggest. I'm currently considering mox at release number 14. I'm still on the fence about it. Ideally people make the decision on the merits of stability, not based on the looks of the version number. But I understand it's used as a signal for how stable software is (but mileage will vary!). At least I'm trying hard not to break anything, so upgrades will work for all installations.
    • dwedge 2y ago
      I've been using it since 0.9 and it has mostly been solid. I had two bugs receiving emails, one where incoming emails didn't work from Microsoft but they fixed that in 0.13, and another incoming issue I can't remember that they fixed in 0.10. I'm not sure if I want to move my main domain over from Exim yet but I'm considering it.
      • mjl- 2y ago
        > incoming emails didn't work from Microsoft but they fixed that in 0.13 Yeah, this one was interesting. It looks like microsoft updated their TLS stack to TLS 1.3, but incorrectly, breaking TLS connections to Go TLS servers. I don't know how to contact Microsoft about it, but others have raised issues with Microsoft. Mox got a workaround (disabling session tickets for SMTP) so Microsofts TLS stack wouldn't abort the connection anymore. This is a downside of being a small guy: You have to work around the bugs of the big guys.
• gigel82 2y ago
  But how do you get a "clean IP" to actually run it on? My ISP's IP changes every so often (whenever there's a power outage for example). Last I checked, you can't run mail servers on typical cloud providers (like Azure, Oracle) and cheap VPSs are almost guaranteed to have "dirty IPs" (used for spam and thus blacklisted).
  • pjerem 2y ago
    Some ISPs can provide you a static IP either for free or by paying a premium.
  • eliaspro 2y ago
    Hetzner served me just well for this purpose for 2 decades now.
  • gabesullice 2y ago
    I have not tried this, but I'm reminded of the post https://rachelbythebay.com/w/2024/09/22/colo/ https://rachelbythebay.com/w/2024/09/22/colo/, which describes how one can host your own infrastructure in a colocation rack, which sounds pretty rad.
  • fasteo 2y ago
    I have used them[1] in the past with good results. * No affiliation [1] https://www.pubconcierge.com/email-marketing https://www.pubconcierge.com/email-marketing
  • jnd-cz 2y ago
    I also expected lowend VPS servers to have tainted IPs but surprisingly they are mostly clean. Currently I run Mox on very cheap $0.6/month (multi year contract) VPS and for the almost half year that I monitor the IP address there was 0 blocklist appearances, mail delivers geneally fine (only had to fish it out of outlook spam at my work address). Most other of my monitored VPS IPs are also completely clean. It seems spammers are not tolerated by those providers.
  • wink 2y ago
    I thought it was going to be a problem when I gave up the IP I've had for a mailserver at hoster A for 15 years and moved to Hetzner, but it wasn't. But of course that's only anecdata, like everything 90% of personal mail server operators will tell you, no one runs several different setups at different IPs/hosters.
• spintin 2y ago
  [dead]
• ThinkBeat 2y ago
  The biggest problem with running your own hosted email server is that the giants (Google, Microsoft, Yahoo ...⁾ tend to block all the incoming mail. Sometimes you can contact them and ask to be removed from whatever list or be allowed. In my experience that lasts about a week, then blocks again. I eventually gave up. Tons of bots out there looking for SMTP serveres too, .
  • sam_goody 2y ago
    I run my own mail server and use postmark for delivery. It is really inexpensive, I don't need to rely on Gmail for anything, and after setup has required almost no interaction for 10+ years.
  • dwedge 2y ago
    I've been hosting three servers for over a decade and only had that problem once for a month with Google about 6 years ago. As long as you setup SPF at a minimum you'll be fine
• xixixao 2y ago
  Is there an implementation of the same capability as a JS lib? So that one could have an email server running as part of their Node.js / other runtime?
  • phoronixrly 2y ago
    What use case do you have in mind? It requires more than just ingesting incoming e-mail?
• patchtopic 2y ago
  perhaps this is a FAQ but does this handle virtual domains like Postfix and Dovecot can? i.e person@fred.com and person@mary.com are completely separate domains/imap accounts on the same server?
  • mjl- 2y ago
    Yes, you can add domains, add accounts (which contain the mailboxes and messages), and configure addresses for the domains with accounts. So one account can have many addresses, at one or more domains, including catchalls.
• Tepix 2y ago
  Do you have plans to support docker, perhaps by creating an official Mox container image?
  • flynumber 2y ago
    The have info on Docker in their GitHub readme Docker Although not recommended, you can also run mox with docker image r.xmox.nl/mox, >with tags like v0.0.1 and v0.0.1-go1.20.1-alpine3.17.2, see >https://r.xmox.nl/r/mox/ https://r.xmox.nl/r/mox/. See https://github.com/mjl-/mox/blob/main/docker- https://github.com/mjl-/mox/blob/main/docker->compose.yml to get started. New docker images aren't (automatically) generated for new Go runtime/compile >releases. It is important to run with docker host networking, so mox can use the public IPs >and has correct remote IP information for incoming connections (important for >junk filtering and rate-limiting).
• kitd 2y ago
  Nice work. Does it include shared folders? I look forward to seeing one of these projects include either that or NNTP support. Then we can get rid of Slack.
• xtat 2y ago
  Really nice- I want a distro package. Managing updates manually gets out of control fast if you run many services.
• Anadorr 2y ago
  Nice, but it's so much easier and cheaper (in time spent) to just use a trusted and secure mail provider with your personal domain. Mailbox.org is my favorite - dkim, encryption, webdav all work out of the box with Android apps available.
• BLKNSLVR 2y ago
  I feel like there's going to a very slow trickle of (a trivial number of) users towards either self-hosting mail or a growing cottage industry of smaller-scale mail services hosted outside the US. Of the growing number of self-hosting options, I'm not sure how many of them are designed to scale, or to what scale they can scale...
• averageRoyalty 2y ago
  A somewhat related tangent, has anyone got good desktop email client recommendations? Preferably macOS/Linux. I have 6ish email accounts I need to monitor, and outside of Outlook (and the various hellish variations of it), I'm yet to find a good client like all smartphones seem to have - all inboxes in one client presented together. I recall having a number of issues with Thunderbird a few years ago when I last tried it, but I don't remember why.
  • amiga386 2y ago
    I'm not sure what your issues were, but Thunderbird is still the king of desktop email clients. It supports a unified inbox, go to the inbox and tick View -> Folders -> Unified
  • KAKAN 2y ago
    I use a mix of Evolution[0] (GNOME's Thunderbird) and Geary[1]. Geary has a very nice UI, and can become mobile-like, and Evolution has much more support for automations and other niceities. There's also alps[2], if you want a web based solution. I love it as well, though Geary is my most used solution. [0]: https://gitlab.gnome.org/GNOME/evolution/-/wikis/home https://gitlab.gnome.org/GNOME/evolution/-/wikis/home [1]: https://wiki.gnome.org/Apps/Geary https://wiki.gnome.org/Apps/Geary [2]: https://sr.ht/~migadu/alps/ https://sr.ht/~migadu/alps/
• amiga386 2y ago
  This seems like a good place to ask - does anyone have recommendations for a mail server and webmail integrated with CalDAV and CardDAV? I was looking at Horde's Imp, Kronolith and Turba so far - https://www.horde.org/apps https://www.horde.org/apps - they seem OK but is there anything else in this area?
  • hkt 2y ago
    https://github.com/mjl-/mox/issues/242 https://github.com/mjl-/mox/issues/242 They're thinking of doing this already and apparently have some pox/prototype code, and a user has suggested a thing in the meantime.
• donatj 2y ago
  Since the late 90s I've always had the thought in the back of my mind that one day I would run my own mail server. That day never came and the task seemed more and more impossible. This looks genuinely manageable, I might actually give this a shot when I get off work.
• kbmn 2y ago
  I've hosted my mailserver myself for years now. I recently (a number of months ago) have started using Mox for my mail server (after using stalwart, manual postfix/dovecot, a couple others). It's a perfect solution for a small personal mailserver. It's among the simplest (/least complicated) mail servers I've used, and I have to waste basically zero time on it. Running backup & update every couple months takes <5 min. However, I noticed: when I showcase it to some people, some of them mistake the very simple minimalist web interface for being ‘outdated’ or similar - it appears that to be "modern", things are required to be extremely bloated, and even technical people look down on fast (seriously: try it) clutter-less design.
  • volemo 2y ago
    I’m honestly curious, what’s the point of a personal mail server nowadays? Isn’t it the case that today they have two huge disadvantages: 1. Being plagued by spam, 2. Being considered spam by major mail services (where most of one’s recipients will usually reside)? Do you face these problems? How do you manage? Are there any potential problems I don’t see?
    • kbmn 2y ago
      > I’m honestly curious, what’s the point of a personal mail server nowadays? There's a large number of cool things possible, my favorite is having a catch-all domain (or multiple). Most of the time when you buy mail hosting from your domain registrar for example, you pay by mailbox. Same goes for the majority of mail hosters in general. With a catch-all domain, you can email <anything>@example.org, and I will get it. I don't have to first generate some addy.io or simplelogin.io or Firefox Relay alias; I can simply enter <company name>@example.org or <service>@example.org when registering on a website, hell I do that even on physical (paper) forms. Later on, I can decide to add an alias with special configuration, e.g.: email arrives at <tax department>@example.org? → Route to "High importance" mailbox; I receive a Newsletter from a company I never heard of → <company name>@example.org sold my email address (and they can't strip the marker off, which they easily could with the +suffix). > Isn’t it the case that today they have two huge disadvantages: > 1. Being plagued by spam, I do not remember having received a single spam email in the last months. In fact, I just looked up the stats: My personal (non-business, non-work) inbox in Thunderbird reaches back to about 2024-03-14, with about 2500 elements. My spam folder currently contains 0 elements. And I don't even have any advanced spam filtering or reputation blacklists or anything similar setup. > 2. Being considered spam by major mail services (where most of one’s recipients will usually reside)? I actually tried this out some months ago with an "email placement tester": I can comfortably reach Gmail & Google Workspace, Hotmail/Office 365/Exchange, and a few others that were tested that I forgot about. I do not remember mails of mine not reaching their intended receiver very often - while this might happen once a year (that you send an email and one second after get a "your message could not be delivered" response), I actually hear about this more often from peers using the largest email provider in the DACH region (GMX), so apparently I rank better? It's usually a misconfiguration from the receiver setting up some scam DNS blocklist (e.g. UCEPROTECT). Wouldn't call this a problem of the mail server though, and as I said, even some rather large (commercial) providers have the same issue. Generally speaking, if you do things right, email will go well for you - this "doing things right" has simply for a long time been quite hard (when postfix/dovecot was prevalent where you need n-number of different third-party software packages, e.g. OpenDMARC). Nowadays, with the modern mail servers available, like Mox (or Stalwart, or Maddy) doing "things right" is very simple: Choose an hoster/ISP with good IP reputation (e.g. check with https://multirbl.valli.org/ https://multirbl.valli.org/ if they are on any blocklists), setup your (modern) mailserver, and you're golden. And this will come with a nice number of advantages: - you have your own domain, so you're portable - you control and are able to customize your email infrastructure (how many mailboxes do I want for my use cases, how would I like different aliases to be mapped to them, catch-all/wildcard, applying scripts on these mailboxes, etc) - privacy/security: Your email (which I consider deeply core to the modern internet infrastructure and ones digital identity (due to controlling the login to basically all websites)) lives on your infrastructure, and no-one but you can access them - selfhosting is fun, and one gains lots of knowledge about inner workings of the internet with it
• -warren 2y ago
  After 21 years of hosting my own email server, starting with roll-your-own (anyone else remember sendmail.cf?) and moving to boxed solutions such as mox or mailcow, I gave up. Maintaining IP reputation and keeping up with the neverending set of arbitrary rules (spf, dkim, etc) I found my time was worth something too. Doing an honest ROI calculation, I figured i was spending 2 hours on average each month keeping the plumbing going. For me, that was well-worth the ~15/month that proton charges. I bet there are other good ones out there too! To be honest though, throughout those decades, I learned a vast amount about how email flows. That knowledge is irreplaceable. My recommendation is to try your own until you really, REALLY understand it. Then move to a paid solution.
• q0uaur 2y ago
  set this up today, the documentation is useful and the quickstart very helpful, the dns stuff pretty much works exactly as it's supposed to and is just a bunch of copypasting (in my registrar's ui). specifically for mox there was some things i would have liked to see: explain how the webmail isn't accessible on the public ip by default - i don't know how many of you want to be in a specific vpn for checking your email, but i sure was surprised i couldn't reach it, but had to activate it in config (and first figure out how to even do that). mox also doesn't redirect to https by default - imo it should, since it already includes the convenient automated certificate setup (which worked great). maybe it is intended for a different environment, but since it recommends not running another webserver on the same host, i really don't want to access the webmail from the local server or by http. i like most of my services being available behind a reverse proxy, there it would make more sense. maybe i'll look into that variant later, but the documentation isn't quite as complete as i'd like.