Your scanner still emails PDFs, your backup scripts still send nightly reports, and none of them will ever learn OAuth 2.0: Email OAuth 2.0 Proxy learns it on their behalf. It listens on local IMAP, POP, and SMTP ports on your server, and when a client logs in the old-fashioned way with a username and password, the proxy swaps that exchange for a modern SASL XOAUTH2 token before the connection ever reaches the provider. The client never knows anything changed, so ancient mail apps, embedded devices, monitoring tools, and hand-rolled scripts keep sending and fetching mail through Outlook, Office 365, Gmail, Google Workspace, Fastmail, Yahoo, AOL, and any other provider that demands OAuth 2.0. The hop from your client to the proxy stays simple, while the proxy opens a fully encrypted TLS connection upstream, including STARTTLS negotiation for SMTP relays that require it. One proxy instance serves many accounts at once, with each mailbox mapped to its own local port and its tokens cached under a password you control. Optional plugins can even rewrite traffic in flight: strip Microsoft Defender Safe Links back to their real URLs, stop duplicate sent messages, or swallow test mail into a black hole. Setup is a single configuration file covering server ports, per-account scopes, and token endpoints, and the proxy then runs quietly as a headless service. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Mail for your own domain stays on your own server with mailez, a self-hosted stack that delivers over SMTP, IMAP, and POP3 and adds a webmail, calendar, contacts, file storage, and an admin console, all started with a single command. Readers get a draggable three-pane webmail that updates itself over a push channel, merges replies into conversations, folds quoted history, and searches with from:, to:, has:attachment, and date terms. Keyboard shortcuts, a command palette, snooze, scheduled send, undo for bulk moves, and quick reply keep daily mail fast, and the interface installs as an offline-capable app with light and dark themes. Privacy-minded users add PGP signing and encryption, two-factor login, and remote-image blocking, and write server-side rules in a Sieve editor. Calendar, contacts, and Drive sit beside mail, with ICS subscriptions, vCard import, CardDAV and CalDAV sync, and share links. Phones and desktop clients configure themselves through autoconfig. Administrators manage domains, mailboxes, aliases, relays, and external mailbox fetching in one console, generate DKIM keys with a click, and follow a DNS wizard and a health page that verify MX, SPF, DMARC, DKIM, blocklists, and MTA-STS. Audit logs and role-based access keep shared servers accountable. The free community edition runs on a single node, while archiving, DLP, LDAP, ActiveSync, and AI features belong to the paid enterprise edition. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 13,000 GitHub stars and active monthly releases, Mailcow delivers a production-ready mail server infrastructure through Docker Compose orchestration of twelve integrated containers. The stack pairs Postfix as the MTA handling SMTP traffic with Dovecot for IMAP and POP3 retrieval featuring the Flatcurve full-text search engine, while Rspamd provides machine-learning-powered spam filtering with Bayesian classification, DKIM signing, and ARC support. ClamAV scans attachments for malware including Office document macro analysis via Olefy, and SOGo serves as a responsive webmail client with CalDAV, CardDAV, and Microsoft ActiveSync synchronization. The admin panel manages multiple domains, per-user spam score thresholds, quarantine review, black and whitelists, temporary spam aliases, mailbox quotas, and TLS enforcement policies for both inbound and outbound messages. Security features include two-factor authentication via TOTP, WebAuthn, and Yubikey OTP, a Fail2ban-like Netfilter integration for brute-force protection, and automatic SPF, DKIM, and DMARC configuration. The ACME container handles Let's Encrypt certificate generation with DNS-01 challenge support, while Postfix TLS-Pol provides MTA-STS and DANE/TLSA resolution for encrypted transport. Built-in imapsync enables periodic migration from remote mailboxes, and the REST API allows programmatic management of all server resources. MariaDB stores user data, Redis caches configuration and sessions, and Unbound provides local DNSSEC-validating DNS resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Modoboa turns a bare mail server into a managed hosting platform, with one web console for domains, mailboxes, aliases, and quotas, plus a full webmail for the people using them. Roles separate super administrators, resellers, domain administrators, and ordinary users, with caps on how many mailboxes and aliases each administrator may create and daily sending limits per domain or mailbox. The webmail offers conversation view, folder subscriptions, scheduled sending, attachments, and search across headers and message bodies. Calendars and address books sync with standard clients, and calendars can be shared. Each user writes Sieve filters and autoreplies in the browser. Deliverability checks cover MX records and DNSBL listings, DKIM keys are generated per domain, and DMARC aggregate reports become per-domain visual reports. Amavis quarantine pages and an Rspamd frontend help with spam. Traffic graphs show message volume. Accounts authenticate against the local database, LDAP, Active Directory, or an existing SMTP server, with TOTP codes or WebAuthn security keys as a second factor. Thunderbird and Outlook configure themselves through built-in autoconfig and autodiscover endpoints. An IMAP migration tool pulls mailboxes from another provider as each person signs in. Administrators can brand the console with custom logos, extend it through plugins, and automate it through a documented REST API. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. ISC licensed.

With over 7,100 GitHub stars and 200 contributors since 2016, Mailu has become one of the most popular self-hosted email solutions, delivering a complete production-ready mail server stack as pre-configured Docker containers that eliminate weeks of manual setup. The platform bundles Postfix for SMTP and Submission with auto-configuration profiles for Thunderbird, Outlook, and mobile clients, Dovecot for IMAP and POP3 with full-text search across email attachments, Rspamd for intelligent spam filtering with auto-learn Bayesian classification, greylisting, SPF and DMARC validation, and ClamAV for antivirus scanning of attachments with configurable malicious file blocking. The web administration interface provides global admin controls, per-domain delegation, user quota management, domain aliases, custom routing rules, and announcement capabilities. Users access self-service features including aliases, auto-reply, auto-forward, fetched accounts from external mailboxes via fetchmail, and Sieve filter management through ManageSieve. Security features include enforced TLS on all connections, automatic Let's Encrypt certificate provisioning, outgoing DKIM signing, DANE and MTA-STS support for transport security, and Snuffleupagus PHP hardening for the web interface. The setup wizard at setup.mailu.io generates complete Docker Compose configurations tailored to specific deployment requirements. All components are free and open-source software with zero proprietary dependencies and no tracking. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Mox offers a complete mail server stack in a single Go binary requiring no external dependencies. The quickstart command configures a working mail server with SMTP, IMAP4, webmail, and full DNS authentication in under ten minutes. SMTP handling includes a delivery server on port 25, a submission server for authenticated clients, and a queue with automatic retries and DKIM signing. IMAP4rev2 implementation provides full mailbox synchronization with CONDSTORE and QRESYNC for efficient offline clients, NOTIFY for multi-mailbox monitoring, MULTISEARCH across mailboxes, and TLS client certificate authentication via the EXTERNAL SASL mechanism. The built-in webmail provides browser-based reading and composing with message threading, attachments, and HTML rendering without requiring a separate web client. Email authentication implements SPF validation, DKIM signing and verification with automatic key rotation, DMARC policy enforcement with aggregate and failure reporting, DANE with DNSSEC-protected TLSA records, and MTA-STS for certificate verification. Junk filtering combines reputation-based sender scoring with Bayesian content analysis trained per account. The web administration interface manages domains, accounts, DNS records, TLS certificates, delivery queue, and real-time log viewing. Internationalized email addresses with EAI and IDNA support handle non-ASCII domains and mailboxes. Account autoconfiguration publishes settings for Thunderbird autoconfig and Outlook autodiscover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With 14,000 GitHub stars and 81 releases since March 2023, Stalwart is the most protocol-complete open-source mail server available — delivering JMAP, IMAP4rev2, IMAP4rev1, POP3, SMTP, CalDAV, CardDAV, and WebDAV from a single Rust binary that compiles to a memory-safe, zero-garbage-collection executable with predictable latency under load. The SMTP server implements DMARC, DKIMv2, DKIMv1, SPF, and ARC for complete message authentication with automatic DKIM key rotation, while transport security enforces DANE, MTA-STS, and SMTP TLS reporting to prevent downgrade attacks. Built-in spam filtering with statistical classifiers, DNS blocklists, and collaborative reputation databases eliminates the need for external Rspamd or SpamAssassin deployments. Encryption at rest protects stored messages with S/MIME or OpenPGP, and automatic TLS certificate provisioning via ACME supports TLS-ALPN-01, DNS-01, and HTTP-01 challenges without manual certificate management. The ManageSieve server enables server-side email filtering rules, while full-text search indexes message bodies and attachments for instant retrieval. Pluggable storage backends support RocksDB for embedded deployments, PostgreSQL, MySQL, and S3-compatible object storage for distributed architectures. LDAP and SQL-based authentication integrate with existing directory services, and the web administration panel manages domains, accounts, quotas, and DKIM keys. Security audited with memory safety guaranteed by Rust's ownership model. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Running a proper mail server used to mean stitching together half a dozen daemons; maddy folds the whole stack into one binary with one configuration file. It receives mail as your MX, sends as your MTA, stores messages for IMAP clients, and signs and verifies with DKIM, SPF, DMARC, DANE, and MTA-STS so other servers actually trust what you send. The design is composable: checks, modifiers, tables, and delivery targets snap together in the config, so spam scoring, address rewriting, and routing rules read like a pipeline instead of a pile of interlocking config files. Outbound mail queues with retries and backoff, inbound delivery lands in IMAP storage backed by SQLite or PostgreSQL, and a built-in ACME client keeps TLS certificates renewed, including DNS-01 providers. Milter support lets existing filters join the pipeline, authentication spans SASL mechanisms and Dovecot delegation, and Prometheus metrics watch queue length and delivery health from your usual dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Mail-in-a-Box turns a single Ubuntu server into a fully functional email system with one setup command, installing and configuring Postfix for SMTP, Dovecot for IMAP, Roundcube for webmail, and Z-Push for Exchange ActiveSync push notifications in an automated sequence that would take days to replicate manually. The DNS server auto-configures the full suite of email authentication records: SPF, DKIM, DMARC, DNSSEC with DANE TLSA, MTA-STS, and SSHFP. Getting all of these right is what separates email that lands in inboxes from email that lands in spam, and most manual installations never achieve the complete set. Nextcloud integration adds CardDAV contact sync and CalDAV calendar sharing across devices. Let's Encrypt certificates provision and renew automatically for every hosted domain. The web control panel manages users, aliases, custom DNS records, and automated backups, protected by TOTP two-factor authentication. Daily health checks verify that services run correctly, ports remain open, TLS certificates stay valid, and DNS records resolve properly, alerting you before delivery problems develop. Multiple domains and users operate from one installation with internationalized domain name support. Built-in HTTPS static site hosting uses the TLS infrastructure already in place. Runs on a dedicated RepoCloud VPS with guaranteed resources, root SSH, and browser serial console for complete email sovereignty. CC0 public domain licensed.

Built as a developer-first alternative to SendGrid, Mailgun, and Postmark, Posta delivers a complete self-hosted email infrastructure platform handling both outbound delivery and inbound reception through a single HTTP API with official SDKs for Go, PHP, and Java. The Go backend processes email through Redis and Asynq with automatic retries, priority queues, and async delivery while PostgreSQL stores templates, contacts, campaigns, and delivery analytics. Outbound features include versioned multi-language templates with variable substitution and stylesheet inlining, bulk campaigns with subscriber targeting and A/B testing per-variant metrics, scheduled timezone-aware delivery with draft/paused/cancelled lifecycle states, email address verification checking syntax, MX records, disposable domains, and role accounts, plus web view links with signed expiring URLs and one-click unsubscribe headers. The built-in SMTP receiver with TLS handles inbound email at your domains, parses messages and attachments, scores spam, and forwards structured payloads to your application via HMAC-verified webhooks with real-time SSE notification streams. The Vue-based dashboard manages templates, SMTP server pools, domains, contacts, API keys, campaigns, and email logs with dark and light mode support while admin-level platform metrics expose delivery rate trends, bounce rate graphs, and latency percentiles alongside Prometheus integration and daily health reports. Deploy via Docker with PostgreSQL and Redis. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

The renewal notice always seems to land in an inbox nobody checks anymore, so Domain Monitor tracks every domain you own from your own server and warns you long before each expiry date arrives. It pulls expiration dates and registrar details automatically through WHOIS and RDAP across more than 1,400 supported TLDs, keeping the whole portfolio current without anyone remembering to look. Add domains one at a time or import them in bulk, group them with tags and watchlists, and let scheduled cron checks refresh the data on their own. Alerts escalate on your schedule, at 60, 30, 21, 14, 7, 5, 3, 2, and 1 day before expiry, and arrive through email, Telegram, Discord, Slack, Mattermost, Pushover, or webhooks, routed by notification groups so the right people hear about the right domains. Each domain also gets tabbed views for its DNS records, SSL certificate validity, billing notes, notification history, and raw WHOIS output, with per-domain toggles for DNS and certificate monitoring. The dashboard surfaces what expires soon, how domains distribute across registrars, and whether every domain is actually covered by an alert channel. Multiple users get their own accounts with two-factor authentication, tracked sessions, and an in-app notification center. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

When the domain you want is already taken, Domain Watchdog tracks its history, warns you as it changes, and can try to register it as soon as it becomes available. Searching any domain returns its registrar, status, nameservers, and registration events from RDAP, the structured JSON successor to WHOIS. A timeline lays out the full lifecycle, from creation through renewals and transfers to final deletion, while deletion forecasting orders tracked domains by their expected drop window. Watchlists group domains with the events that matter, send alerts by email or as webhooks to Slack, Mattermost, or Discord, and publish an iCal feed plus RSS feeds for events and EPP status. Attach a connector for OVH, Gandi, Namecheap, AutoDNS, or Name.com, and an expired domain on the watchlist triggers an order attempt through that provider's API. The app also lists ICANN-accredited registrars and TLDs, and rate limiting with caching minimizes RDAP requests. Administrators can cap watchlists, domains per watchlist, and webhooks per watchlist, toggle public RDAP lookups, and add custom static content to the instance. Scripts can manage watchlists and connectors, search domains, and request user tokens through the documented REST API. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Raw zone files and API calls become something a whole team can operate safely once PowerDNS-Admin puts its web interface in front of a PowerDNS authoritative server. It's a Python/Flask application covering full forward and reverse zone management, with the touches that matter in daily DNS work: zone templates for stamping out consistent new domains, easy IPv6 PTR record editing (reverse zones by hand are misery), full IDN/Punycode support for internationalized domains, and DynDNS 2 protocol support so routers and scripts can update records the way they would against a commercial dynamic-DNS service. Access control is enterprise-grade: local users, LDAP against OpenLDAP or Active Directory, SAML, and OAuth via Google, GitHub, Azure, or OpenID Connect, hardened with TOTP two-factor authentication. Role-based permissions extend to zone-specific access control - hand a developer their project's zone without exposing the rest of your namespace - and activity logging records who changed which record when, the audit trail bare PowerDNS never gives you. The dashboard monitors PDNS service configuration and statistics, and its own API exposes zone and record management for automation on top of the UI. Runs against MySQL/MariaDB or PostgreSQL, talking to PowerDNS through its REST API. MIT-licensed.

PowerDNS answers the queries; Poweradmin gives you a browser-based control panel for its zones, records, DNSSEC keys, and users, with a REST API for automation. Create master, native, and slave zones, and let zone templates stamp predefined record sets onto new ones. Edit records inline with filters, or open the optional Record Wizard for DMARC, SPF, DKIM, CAA, TLSA, and SRV. Reverse zones link to their forward zones. The batch PTR tool fills whole network ranges, bulk add takes one CSV line per record, and secondary zones can be imported over AXFR. For DNSSEC, manage keys and copy DS and DNSKEY records for your registrar; changes are applied or rectified through the PowerDNS API so signed zones stay consistent. Every record and zone edit is logged with before and after snapshots, and the logs can be filtered and exported. The panel is translated into 43 languages, including right-to-left ones. Permission templates, users, and groups control who touches which zones, sign-in works through LDAP, OIDC, or SAML, and administrators can switch on authenticator-app or email two-factor codes. API keys can be read-only, limited to chosen operations, or restricted to specific zones, and companion projects link Terraform, ExternalDNS, cert-manager, and Certbot. Dynamic DNS clients such as ddclient and inadyn update records through a dyndns2-compatible endpoint. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Subnet math, DNS lookups, DHCP options, and certificate checks share one browser tab in Networking Toolbox, a free toolkit for sysadmins and network engineers. Need to carve a /24 into departments? The VLSM planner fits named subnet requirements into a parent block, reports each subnet's efficiency and the leftover space, and exports the plan as CSV or JSON. Merging address lists? CIDR utilities summarize, split, compare, and deaggregate prefixes, with set operations for difference, overlap, and containment. Writing configs? Generators build DHCPv4 and DHCPv6 options, PXE profiles, Kea or ISC snippets, and SPF, DKIM, DMARC, CAA, TLSA, and SRV records, and DNSSEC helpers calculate key tags and DS records. Something broken? Diagnostics query DNS through Cloudflare, Google, Quad9, OpenDNS, or a resolver of your choice, read TLS certificate chains, grade HTTP security headers, trace redirects, check TCP ports, look up BGP routes and RDAP records, and test mail servers. Need a refresher? Reference guides explain private ranges, CGNAT, IPv6 address types, and common ports. A keyboard search palette puts any tool a few keystrokes away, and bookmarked tools stay available offline. Eighteen themes, four languages, custom branding, and accessibility switches make it feel like your own, and a keyless JSON API serves the subnet, CIDR, IP, and DNS utilities to scripts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Sixty-thousand-plus GitHub stars make Uptime Kuma the most popular self-hosted monitoring tool - MIT-licensed, Node.js, and the standard replacement for UptimeRobot, Pingdom, and Freshping. It watches a dozen monitor types: HTTP(S) endpoints with keyword and JSON-query content validation, TCP ports, ICMP ping, DNS records, WebSockets, Docker containers via the socket, Steam game servers, MQTT brokers, gRPC services, and push-based heartbeats for cron jobs and internal workers. Checks run at intervals as tight as 20 seconds - versus UptimeRobot's 5-minute free tier - with unlimited monitors and unlimited data retention. When something fails, alerts fan out through 90+ notification channels: Slack, Discord, Telegram, email with LiquidJS templating, PagerDuty, OpsGenie, ntfy, Gotify, Matrix, and dozens more via native providers plus the Apprise library. Unlimited public or password-protected status pages - mappable to specific domains and organized into monitor groups - communicate health to customers, with maintenance windows that suppress alerts during planned work. The reactive dashboard graphs response times, tracks SSL certificate expiry with advance warnings, supports proxies and 2FA, and ships in dozens of languages. One Docker container with a SQLite volume covers an entire infrastructure.