Every email your app sends while you build and test it lands in OwlMail's browser inbox instead of a customer's mailbox. Point any application's SMTP settings at OwlMail and every message is ready to open as rendered HTML, plain text, headers, or raw source. Attachments and inline images sit beside the body, and seven preset preview widths show how the message lays out on phones, tablets, and desktops before anyone real sees it. A Verify panel checks subject, body, and link hosts against expectations, while CI pipelines use the REST API with delivery cursors to wait for exactly the messages their test run produced, assert on them, and clean up afterwards. Coding agents get the same inbox read-only over MCP, so an assistant can confirm a signup email arrived without touching your mail server. When a message proves itself, relay it onwards to a real SMTP server, by hand or automatically under filtering rules, or fire webhooks with HMAC signatures and retry queues into the rest of your automation. Everything stores as plain .eml files on disk, with optional SQLite indexing, S3 attachment storage, and ZIP exports for archiving. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Mox offers a complete mail server stack in a single Go binary requiring no external dependencies. The quickstart command configures a working mail server with SMTP, IMAP4, webmail, and full DNS authentication in under ten minutes. SMTP handling includes a delivery server on port 25, a submission server for authenticated clients, and a queue with automatic retries and DKIM signing. IMAP4rev2 implementation provides full mailbox synchronization with CONDSTORE and QRESYNC for efficient offline clients, NOTIFY for multi-mailbox monitoring, MULTISEARCH across mailboxes, and TLS client certificate authentication via the EXTERNAL SASL mechanism. The built-in webmail provides browser-based reading and composing with message threading, attachments, and HTML rendering without requiring a separate web client. Email authentication implements SPF validation, DKIM signing and verification with automatic key rotation, DMARC policy enforcement with aggregate and failure reporting, DANE with DNSSEC-protected TLSA records, and MTA-STS for certificate verification. Junk filtering combines reputation-based sender scoring with Bayesian content analysis trained per account. The web administration interface manages domains, accounts, DNS records, TLS certificates, delivery queue, and real-time log viewing. Internationalized email addresses with EAI and IDNA support handle non-ASCII domains and mailboxes. Account autoconfiguration publishes settings for Thunderbird autoconfig and Outlook autodiscover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 7,100 GitHub stars and 200 contributors since 2016, Mailu has become one of the most popular self-hosted email solutions, delivering a complete production-ready mail server stack as pre-configured Docker containers that eliminate weeks of manual setup. The platform bundles Postfix for SMTP and Submission with auto-configuration profiles for Thunderbird, Outlook, and mobile clients, Dovecot for IMAP and POP3 with full-text search across email attachments, Rspamd for intelligent spam filtering with auto-learn Bayesian classification, greylisting, SPF and DMARC validation, and ClamAV for antivirus scanning of attachments with configurable malicious file blocking. The web administration interface provides global admin controls, per-domain delegation, user quota management, domain aliases, custom routing rules, and announcement capabilities. Users access self-service features including aliases, auto-reply, auto-forward, fetched accounts from external mailboxes via fetchmail, and Sieve filter management through ManageSieve. Security features include enforced TLS on all connections, automatic Let's Encrypt certificate provisioning, outgoing DKIM signing, DANE and MTA-STS support for transport security, and Snuffleupagus PHP hardening for the web interface. The setup wizard at setup.mailu.io generates complete Docker Compose configurations tailored to specific deployment requirements. All components are free and open-source software with zero proprietary dependencies and no tracking. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 13,000 GitHub stars and active monthly releases, Mailcow delivers a production-ready mail server infrastructure through Docker Compose orchestration of twelve integrated containers. The stack pairs Postfix as the MTA handling SMTP traffic with Dovecot for IMAP and POP3 retrieval featuring the Flatcurve full-text search engine, while Rspamd provides machine-learning-powered spam filtering with Bayesian classification, DKIM signing, and ARC support. ClamAV scans attachments for malware including Office document macro analysis via Olefy, and SOGo serves as a responsive webmail client with CalDAV, CardDAV, and Microsoft ActiveSync synchronization. The admin panel manages multiple domains, per-user spam score thresholds, quarantine review, black and whitelists, temporary spam aliases, mailbox quotas, and TLS enforcement policies for both inbound and outbound messages. Security features include two-factor authentication via TOTP, WebAuthn, and Yubikey OTP, a Fail2ban-like Netfilter integration for brute-force protection, and automatic SPF, DKIM, and DMARC configuration. The ACME container handles Let's Encrypt certificate generation with DNS-01 challenge support, while Postfix TLS-Pol provides MTA-STS and DANE/TLSA resolution for encrypted transport. Built-in imapsync enables periodic migration from remote mailboxes, and the REST API allows programmatic management of all server resources. MariaDB stores user data, Redis caches configuration and sessions, and Unbound provides local DNSSEC-validating DNS resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Modoboa turns a bare mail server into a managed hosting platform, with one web console for domains, mailboxes, aliases, and quotas, plus a full webmail for the people using them. Roles separate super administrators, resellers, domain administrators, and ordinary users, with caps on how many mailboxes and aliases each administrator may create and daily sending limits per domain or mailbox. The webmail offers conversation view, folder subscriptions, scheduled sending, attachments, and search across headers and message bodies. Calendars and address books sync with standard clients, and calendars can be shared. Each user writes Sieve filters and autoreplies in the browser. Deliverability checks cover MX records and DNSBL listings, DKIM keys are generated per domain, and DMARC aggregate reports become per-domain visual reports. Amavis quarantine pages and an Rspamd frontend help with spam. Traffic graphs show message volume. Accounts authenticate against the local database, LDAP, Active Directory, or an existing SMTP server, with TOTP codes or WebAuthn security keys as a second factor. Thunderbird and Outlook configure themselves through built-in autoconfig and autodiscover endpoints. An IMAP migration tool pulls mailboxes from another provider as each person signs in. Administrators can brand the console with custom logos, extend it through plugins, and automate it through a documented REST API. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. ISC licensed.

Mail-in-a-Box turns a single Ubuntu server into a fully functional email system with one setup command, installing and configuring Postfix for SMTP, Dovecot for IMAP, Roundcube for webmail, and Z-Push for Exchange ActiveSync push notifications in an automated sequence that would take days to replicate manually. The DNS server auto-configures the full suite of email authentication records: SPF, DKIM, DMARC, DNSSEC with DANE TLSA, MTA-STS, and SSHFP. Getting all of these right is what separates email that lands in inboxes from email that lands in spam, and most manual installations never achieve the complete set. Nextcloud integration adds CardDAV contact sync and CalDAV calendar sharing across devices. Let's Encrypt certificates provision and renew automatically for every hosted domain. The web control panel manages users, aliases, custom DNS records, and automated backups, protected by TOTP two-factor authentication. Daily health checks verify that services run correctly, ports remain open, TLS certificates stay valid, and DNS records resolve properly, alerting you before delivery problems develop. Multiple domains and users operate from one installation with internationalized domain name support. Built-in HTTPS static site hosting uses the TLS infrastructure already in place. Runs on a dedicated RepoCloud VPS with guaranteed resources, root SSH, and browser serial console for complete email sovereignty. CC0 public domain licensed.

Mail for your own domain stays on your own server with mailez, a self-hosted stack that delivers over SMTP, IMAP, and POP3 and adds a webmail, calendar, contacts, file storage, and an admin console, all started with a single command. Readers get a draggable three-pane webmail that updates itself over a push channel, merges replies into conversations, folds quoted history, and searches with from:, to:, has:attachment, and date terms. Keyboard shortcuts, a command palette, snooze, scheduled send, undo for bulk moves, and quick reply keep daily mail fast, and the interface installs as an offline-capable app with light and dark themes. Privacy-minded users add PGP signing and encryption, two-factor login, and remote-image blocking, and write server-side rules in a Sieve editor. Calendar, contacts, and Drive sit beside mail, with ICS subscriptions, vCard import, CardDAV and CalDAV sync, and share links. Phones and desktop clients configure themselves through autoconfig. Administrators manage domains, mailboxes, aliases, relays, and external mailbox fetching in one console, generate DKIM keys with a click, and follow a DNS wizard and a health page that verify MX, SPF, DMARC, DKIM, blocklists, and MTA-STS. Audit logs and role-based access keep shared servers accountable. The free community edition runs on a single node, while archiving, DLP, LDAP, ActiveSync, and AI features belong to the paid enterprise edition. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Stalwart replaces the traditional Postfix + Dovecot + SpamAssassin + calendar-server stack with one Rust binary that speaks every standard mail and collaboration protocol natively. JMAP, IMAP4rev2, POP3, SMTP, CalDAV, CardDAV, and WebDAV all run inside the same process — no glue scripts, no sidecar daemons, no version conflicts between components. The pluggable storage architecture lets operators choose RocksDB for single-node deployments, FoundationDB for distributed clusters, PostgreSQL, MySQL/MariaDB, or SQLite for the data store, S3/MinIO/Azure Blob for message blobs, and Elasticsearch or Meilisearch for full-text search, with Redis or the internal engine backing rate limiters and session state. Security features include S/MIME and OpenPGP encryption at rest, automated DKIM key generation with DNS publication, DANE and MTA-STS transport security, automatic ACME TLS provisioning, granular ACLs, rate limiting, and IP banning. The browser-based admin console manages accounts, domains, groups, mailing lists, SMTP queues, DMARC/TLS-RPT/ARF reports, and every configuration object without touching a config file, while the self-service portal at /account gives end users password reset and encryption key management. Multi-tenant support with per-tenant quotas enables hosting-platform deployments, and coordinator-less clustering via Zenoh or NATS scales horizontally by adding nodes. Deploy via Docker or the standalone binary. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

Sign up for a new service and you face a familiar choice: hand over your real email and get spam-listed forever, or generate a throwaway alias that dies when you close the tab. AliasVault eliminates that trade-off by combining a password manager with a built-in email server, so every website gets a unique identity (random email, generated name, strong password) and incoming emails land directly in your encrypted vault rather than your primary inbox. Creating a new alias takes one click: the system generates a random address on your configured domain, a fake identity with name and birthdate, and a cryptographically strong password, all stored in a zero-knowledge encrypted vault that even the server administrator cannot read. Browser extensions for Chrome, Firefox, Edge, Safari, and Brave detect login forms and autofill credentials or prompt you to create a new alias on the spot. Native iOS and Android apps with biometric unlock provide mobile access to your vault and integrate with the operating system's autofill framework. The built-in TOTP authenticator generates time-based one-time codes without needing a separate app. Import existing credentials from other password managers through standard export formats, and export your vault data at any time for full portability. Self-hosting via Docker with your own email domain gives you complete control over where alias mail is received and stored, with no third-party dependencies. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your scanner still emails PDFs, your backup scripts still send nightly reports, and none of them will ever learn OAuth 2.0: Email OAuth 2.0 Proxy learns it on their behalf. It listens on local IMAP, POP, and SMTP ports on your server, and when a client logs in the old-fashioned way with a username and password, the proxy swaps that exchange for a modern SASL XOAUTH2 token before the connection ever reaches the provider. The client never knows anything changed, so ancient mail apps, embedded devices, monitoring tools, and hand-rolled scripts keep sending and fetching mail through Outlook, Office 365, Gmail, Google Workspace, Fastmail, Yahoo, AOL, and any other provider that demands OAuth 2.0. The hop from your client to the proxy stays simple, while the proxy opens a fully encrypted TLS connection upstream, including STARTTLS negotiation for SMTP relays that require it. One proxy instance serves many accounts at once, with each mailbox mapped to its own local port and its tokens cached under a password you control. Optional plugins can even rewrite traffic in flight: strip Microsoft Defender Safe Links back to their real URLs, stop duplicate sent messages, or swallow test mail into a black hole. Setup is a single configuration file covering server ports, per-account scopes, and token endpoints, and the proxy then runs quietly as a headless service. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

CAPTCHAs make every visitor solve a puzzle to prove they are human; Mosparo takes the opposite route and checks the submitted content itself, no challenges, no image grids, and no tracking cookies. Drop the customizable checkbox widget into any form and Mosparo inspects each field separately, scoring the entry against your rules the way an email spam filter scores a message. Build field rules for banned words, domains, email addresses, IP addresses and subnets, providers, Unicode blocks, user agents, and websites, each with its own rating weight, or subscribe to shared rule packages that refresh themselves automatically. Every submission lands in an admin inbox with its spam rating, IP address, and verification status, and dashboard charts show valid versus spam traffic plus delayed or blocked requests over time. Legitimate users notice nothing but a plain checkbox, which stays fully usable with assistive technology, while everything Mosparo stores is encrypted and automatically deleted after 14 days. Run one instance for many sites with separate projects, project groups, and member roles, and connect your forms over the documented API from any stack that can send an HTTP request. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.