Parse DMARC reads the DMARC aggregate reports that Google, Microsoft, and Yahoo email about your domain every day and shows you, in one dashboard, who is sending mail as you and whether it passes authentication. It fetches the reports over IMAP, unpacks the gzip, zip, and XML attachments automatically, and charts your pass rate, message volume, and top sending sources at a glance. Any report opens down to its raw records, so when an unfamiliar IP starts sending as you, the evidence is one click away instead of buried in XML. Reports forwarded through Exchange or Outlook as message attachments are unwrapped too, and a local Maildir intake covers servers where the mailbox lives on the same host. A built-in generator writes your _dmarc TXT record from a form, so tightening your policy does not mean hand-writing DNS syntax from memory. Twenty-eight Prometheus metrics and a shipped Grafana dashboard move the same data into the monitoring stack you already run. An MCP server lets an AI assistant query your reports directly, asking which sources failed DKIM this week in plain language. Everything stores in a single SQLite file inside one static Go binary, with dark mode for late-night incident reviews. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Monitor watches your servers the way a status page should: second by second, from one small binary you run yourself. A lightweight Linux agent on each machine reports CPU, memory, disks, network throughput, connections, and processes to your hub over a persistent connection, and the hub pushes a fresh snapshot to your browser every two seconds. History is kept for charting, so node pages show how load, traffic, and latency behaved over days. Ping tasks run from the hub's side too: define targets once and every agent measures latency to them on its own interval, drawing the curves next to the machine metrics. The public face is a status page you can reskin without touching the server: themes install from the panel, run as static pages against a small public API, and anonymous visitors see only the nodes you marked public, with addresses and hostnames stripped out. Node management stays practical: registration windows hand out tokens safely, installing an agent is one command, and replacing a token disconnects the old connection immediately. When a node goes offline, crosses its traffic allowance, approaches expiry, or someone signs in, alerts go out through Telegram or any webhook. The hub listens only on localhost behind your HTTPS proxy, signs in by password or GitHub OAuth allowlist, and lists revocable sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

The renewal notice always seems to land in an inbox nobody checks anymore, so Domain Monitor tracks every domain you own from your own server and warns you long before each expiry date arrives. It pulls expiration dates and registrar details automatically through WHOIS and RDAP across more than 1,400 supported TLDs, keeping the whole portfolio current without anyone remembering to look. Add domains one at a time or import them in bulk, group them with tags and watchlists, and let scheduled cron checks refresh the data on their own. Alerts escalate on your schedule, at 60, 30, 21, 14, 7, 5, 3, 2, and 1 day before expiry, and arrive through email, Telegram, Discord, Slack, Mattermost, Pushover, or webhooks, routed by notification groups so the right people hear about the right domains. Each domain also gets tabbed views for its DNS records, SSL certificate validity, billing notes, notification history, and raw WHOIS output, with per-domain toggles for DNS and certificate monitoring. The dashboard surfaces what expires soon, how domains distribute across registrars, and whether every domain is actually covered by an alert channel. Multiple users get their own accounts with two-factor authentication, tracked sessions, and an in-app notification center. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Across personal mailboxes and business domains alike, Mail-Archiver captures, indexes, and preserves every incoming and outgoing email from multiple IMAP and Microsoft 365 accounts in a tamper-resistant archive. Connect standard IMAP servers, Microsoft 365 business tenants via Microsoft Graph, or personal Outlook and Hotmail accounts using OAuth2 device code flow without creating custom cloud app registrations. Scheduled background synchronization mirrors complete folder hierarchies automatically, while bulk tenant onboarding lets administrators import every active mailbox from a Microsoft 365 organization through a single configuration screen. When an important contract, invoice, or correspondence thread goes missing, the advanced search interface filters archived messages by sender, recipient, subject, date range, folder, and body text with instant HTML preview and direct attachment downloads. Users can import legacy MBox files or zipped EML archives, export selected messages or entire accounts, and run direct mailbox-to-mailbox migrations that copy folder trees between providers. Granular retention rules optionally purge aged messages from upstream mail servers to free quota while keeping local archive copies locked against manual deletion for compliance auditing. Multi-user access controls, OpenID Connect single sign-on, detailed activity audit logs, a scoped read-only REST API, and a Model Context Protocol endpoint allow both teams and AI assistants to query historical mail safely. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Mox offers a complete mail server stack in a single Go binary requiring no external dependencies. The quickstart command configures a working mail server with SMTP, IMAP4, webmail, and full DNS authentication in under ten minutes. SMTP handling includes a delivery server on port 25, a submission server for authenticated clients, and a queue with automatic retries and DKIM signing. IMAP4rev2 implementation provides full mailbox synchronization with CONDSTORE and QRESYNC for efficient offline clients, NOTIFY for multi-mailbox monitoring, MULTISEARCH across mailboxes, and TLS client certificate authentication via the EXTERNAL SASL mechanism. The built-in webmail provides browser-based reading and composing with message threading, attachments, and HTML rendering without requiring a separate web client. Email authentication implements SPF validation, DKIM signing and verification with automatic key rotation, DMARC policy enforcement with aggregate and failure reporting, DANE with DNSSEC-protected TLSA records, and MTA-STS for certificate verification. Junk filtering combines reputation-based sender scoring with Bayesian content analysis trained per account. The web administration interface manages domains, accounts, DNS records, TLS certificates, delivery queue, and real-time log viewing. Internationalized email addresses with EAI and IDNA support handle non-ASCII domains and mailboxes. Account autoconfiguration publishes settings for Thunderbird autoconfig and Outlook autodiscover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 13,000 GitHub stars and active monthly releases, Mailcow delivers a production-ready mail server infrastructure through Docker Compose orchestration of twelve integrated containers. The stack pairs Postfix as the MTA handling SMTP traffic with Dovecot for IMAP and POP3 retrieval featuring the Flatcurve full-text search engine, while Rspamd provides machine-learning-powered spam filtering with Bayesian classification, DKIM signing, and ARC support. ClamAV scans attachments for malware including Office document macro analysis via Olefy, and SOGo serves as a responsive webmail client with CalDAV, CardDAV, and Microsoft ActiveSync synchronization. The admin panel manages multiple domains, per-user spam score thresholds, quarantine review, black and whitelists, temporary spam aliases, mailbox quotas, and TLS enforcement policies for both inbound and outbound messages. Security features include two-factor authentication via TOTP, WebAuthn, and Yubikey OTP, a Fail2ban-like Netfilter integration for brute-force protection, and automatic SPF, DKIM, and DMARC configuration. The ACME container handles Let's Encrypt certificate generation with DNS-01 challenge support, while Postfix TLS-Pol provides MTA-STS and DANE/TLSA resolution for encrypted transport. Built-in imapsync enables periodic migration from remote mailboxes, and the REST API allows programmatic management of all server resources. MariaDB stores user data, Redis caches configuration and sessions, and Unbound provides local DNSSEC-validating DNS resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Modoboa turns a bare mail server into a managed hosting platform, with one web console for domains, mailboxes, aliases, and quotas, plus a full webmail for the people using them. Roles separate super administrators, resellers, domain administrators, and ordinary users, with caps on how many mailboxes and aliases each administrator may create and daily sending limits per domain or mailbox. The webmail offers conversation view, folder subscriptions, scheduled sending, attachments, and search across headers and message bodies. Calendars and address books sync with standard clients, and calendars can be shared. Each user writes Sieve filters and autoreplies in the browser. Deliverability checks cover MX records and DNSBL listings, DKIM keys are generated per domain, and DMARC aggregate reports become per-domain visual reports. Amavis quarantine pages and an Rspamd frontend help with spam. Traffic graphs show message volume. Accounts authenticate against the local database, LDAP, Active Directory, or an existing SMTP server, with TOTP codes or WebAuthn security keys as a second factor. Thunderbird and Outlook configure themselves through built-in autoconfig and autodiscover endpoints. An IMAP migration tool pulls mailboxes from another provider as each person signs in. Administrators can brand the console with custom logos, extend it through plugins, and automate it through a documented REST API. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. ISC licensed.

With 14,000 GitHub stars and 81 releases since March 2023, Stalwart is the most protocol-complete open-source mail server available — delivering JMAP, IMAP4rev2, IMAP4rev1, POP3, SMTP, CalDAV, CardDAV, and WebDAV from a single Rust binary that compiles to a memory-safe, zero-garbage-collection executable with predictable latency under load. The SMTP server implements DMARC, DKIMv2, DKIMv1, SPF, and ARC for complete message authentication with automatic DKIM key rotation, while transport security enforces DANE, MTA-STS, and SMTP TLS reporting to prevent downgrade attacks. Built-in spam filtering with statistical classifiers, DNS blocklists, and collaborative reputation databases eliminates the need for external Rspamd or SpamAssassin deployments. Encryption at rest protects stored messages with S/MIME or OpenPGP, and automatic TLS certificate provisioning via ACME supports TLS-ALPN-01, DNS-01, and HTTP-01 challenges without manual certificate management. The ManageSieve server enables server-side email filtering rules, while full-text search indexes message bodies and attachments for instant retrieval. Pluggable storage backends support RocksDB for embedded deployments, PostgreSQL, MySQL, and S3-compatible object storage for distributed architectures. LDAP and SQL-based authentication integrate with existing directory services, and the web administration panel manages domains, accounts, quotas, and DKIM keys. Security audited with memory safety guaranteed by Rust's ownership model. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 7,100 GitHub stars and 200 contributors since 2016, Mailu has become one of the most popular self-hosted email solutions, delivering a complete production-ready mail server stack as pre-configured Docker containers that eliminate weeks of manual setup. The platform bundles Postfix for SMTP and Submission with auto-configuration profiles for Thunderbird, Outlook, and mobile clients, Dovecot for IMAP and POP3 with full-text search across email attachments, Rspamd for intelligent spam filtering with auto-learn Bayesian classification, greylisting, SPF and DMARC validation, and ClamAV for antivirus scanning of attachments with configurable malicious file blocking. The web administration interface provides global admin controls, per-domain delegation, user quota management, domain aliases, custom routing rules, and announcement capabilities. Users access self-service features including aliases, auto-reply, auto-forward, fetched accounts from external mailboxes via fetchmail, and Sieve filter management through ManageSieve. Security features include enforced TLS on all connections, automatic Let's Encrypt certificate provisioning, outgoing DKIM signing, DANE and MTA-STS support for transport security, and Snuffleupagus PHP hardening for the web interface. The setup wizard at setup.mailu.io generates complete Docker Compose configurations tailored to specific deployment requirements. All components are free and open-source software with zero proprietary dependencies and no tracking. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Mail for your own domain stays on your own server with mailez, a self-hosted stack that delivers over SMTP, IMAP, and POP3 and adds a webmail, calendar, contacts, file storage, and an admin console, all started with a single command. Readers get a draggable three-pane webmail that updates itself over a push channel, merges replies into conversations, folds quoted history, and searches with from:, to:, has:attachment, and date terms. Keyboard shortcuts, a command palette, snooze, scheduled send, undo for bulk moves, and quick reply keep daily mail fast, and the interface installs as an offline-capable app with light and dark themes. Privacy-minded users add PGP signing and encryption, two-factor login, and remote-image blocking, and write server-side rules in a Sieve editor. Calendar, contacts, and Drive sit beside mail, with ICS subscriptions, vCard import, CardDAV and CalDAV sync, and share links. Phones and desktop clients configure themselves through autoconfig. Administrators manage domains, mailboxes, aliases, relays, and external mailbox fetching in one console, generate DKIM keys with a click, and follow a DNS wizard and a health page that verify MX, SPF, DMARC, DKIM, blocklists, and MTA-STS. Audit logs and role-based access keep shared servers accountable. The free community edition runs on a single node, while archiving, DLP, LDAP, ActiveSync, and AI features belong to the paid enterprise edition. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your application already knows how to send mail through Amazon SES; NitroMTA lets it keep that code, change the endpoint and keys, and deliver from IP addresses you actually control. The engine answers a submission only after the message is committed to disk, so accepted mail survives a crash, a power cut, and even the loss of its host when the disk survives. Capture mode runs the whole engine locally and shows each message in a browser at port 9090 instead of sending it, which makes testing painless before any DNS exists. Out in production, new IPs warm up receiver by receiver from fifty messages a day, rising after clean days and backing off when complaints, bounces, or throttling climb. Each provider gets its own connection limits and cooldowns, hard bounces and spam complaints suppress the address automatically, and outgoing mail is DKIM-signed and sent over TLS with MTA-STS and DANE verified where published. Templates, identities, configuration sets, tenants, dedicated IPs, and SES-shaped events through an SNS subset cover the SES surface your tooling expects, and a CLI explains why any given message is still waiting. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Mail-in-a-Box turns a single Ubuntu server into a fully functional email system with one setup command, installing and configuring Postfix for SMTP, Dovecot for IMAP, Roundcube for webmail, and Z-Push for Exchange ActiveSync push notifications in an automated sequence that would take days to replicate manually. The DNS server auto-configures the full suite of email authentication records: SPF, DKIM, DMARC, DNSSEC with DANE TLSA, MTA-STS, and SSHFP. Getting all of these right is what separates email that lands in inboxes from email that lands in spam, and most manual installations never achieve the complete set. Nextcloud integration adds CardDAV contact sync and CalDAV calendar sharing across devices. Let's Encrypt certificates provision and renew automatically for every hosted domain. The web control panel manages users, aliases, custom DNS records, and automated backups, protected by TOTP two-factor authentication. Daily health checks verify that services run correctly, ports remain open, TLS certificates stay valid, and DNS records resolve properly, alerting you before delivery problems develop. Multiple domains and users operate from one installation with internationalized domain name support. Built-in HTTPS static site hosting uses the TLS infrastructure already in place. Runs on a dedicated RepoCloud VPS with guaranteed resources, root SSH, and browser serial console for complete email sovereignty. CC0 public domain licensed.

Continuous infrastructure monitoring meets automated SSL expiration tracking in Kuvasz, a self-hosted uptime platform that alerts DevOps teams before outages disrupt production operations. Operators can configure granular health checks across HTTP endpoints, ICMP ping targets, and raw TCP ports with custom polling intervals down to seconds. Automated SSL inspectors track certificate validity, issuing early warning notices before cryptographic chains expire and disrupt production traffic. A push monitoring system receives incoming heartbeat signals from background cron jobs, database backups, and recurring automation scripts, triggering alerts whenever expected pings fail to arrive on schedule. Multi-channel dispatchers route incident notifications through Slack, Discord, Telegram, Microsoft Teams, PagerDuty, and custom webhook payloads with adjustable failure count thresholds to eliminate transient false alarms. Maintenance windows let teams schedule planned downtime through one-off intervals or recurring cron expressions, automatically muting notifications during deployment cycles. Public and private status pages publish categorized system health metrics, historical latency charts, and incident timelines to keep internal stakeholders and end users informed. An integrated Model Context Protocol server allows AI assistants to query monitoring states and toggle checks directly via conversational interfaces. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 14,000 GitHub stars and a growing global network of security deployments, CrowdSec turns every attack on any participating server into protection for the entire community. The security engine operates as a combined IDS/IPS and WAF, analyzing log sources from Nginx, Apache, SSH, WordPress, and over 50 other services to detect brute force attacks, port scans, web vulnerability exploitation, and credential stuffing in real time. When one server detects a new threat, the attacker's IP is shared through the community blocklist, proactively protecting thousands of other installations before the attacker can reach them. The built-in WAF powered by Coraza v3 inspects HTTP requests at the application layer, validates against OpenAPI schemas, and applies custom rules with flexible AND/OR condition mixing for precise threat detection. Bot detection serves challenge pages with client fingerprinting to distinguish legitimate traffic from automated scrapers and scanners. Remediation components block malicious IPs at multiple infrastructure layers including iptables, nftables, Nginx, HAProxy, Cloudflare, and AWS Security Groups through the detect-here-remedy-there architecture. The scenario-based detection system ships with default rules for common attack patterns and supports custom scenarios written in YAML with an expressive filter language. A centralized console provides real-time visualization of alerts, threat intelligence analysis, and management of multiple distributed security engines. GDPR compliant by design, all log analysis happens locally and raw logs never leave your infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

MISP is an open source threat intelligence platform where analysts log indicators and incidents, see how they connect, and share them with trusted organizations. Each case is an event holding attributes and structured objects such as files, network connections, and email messages, with Markdown reports beside the machine-readable data. A correlation engine links events that share values, including fuzzy-hash and CIDR matches, and warning lists flag benign values before they cause false positives. Taxonomies and galaxies tag events with TLP levels, threat actors, malware families, and MITRE ATT&CK techniques. Analysts explore relationships in an event graph and a correlation graph with a timeline, and build drag-and-drop dashboards with maps and ATT&CK heatmaps. Sharing groups control who sees which event, and instances synchronize with partner organizations with distribution settings down to a single attribute. Free-text, URL, bulk, and STIX imports fill the database, and exports reach Suricata, Snort, Zeek, OpenIOC, CSV, STIX 1 and 2, and RPZ zones. A REST API, the PyMISP library, expansion modules, and workflows enrich data and automate publishing. ZeroMQ and Kafka streams announce every change to connected tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.