Mailer Services¶

The mailer layer is the beating heart of Mailyte. These are the services that actually move, store, filter, and protect email. They run as separate Docker containers and communicate over the internal Docker network.

Architecture at a Glance¶

flowchart TB
    Internet((Internet))

    subgraph Mailer["Mailer Services"]
        direction TB
        Postfix["Postfix\nSMTP MTA\n:25 / :587 / :465"]
        Dovecot["Dovecot\nIMAP/POP3\n:143 / :993 / :110 / :995"]
        Rspamd["Rspamd\nAnti-Spam\n:11332 / :11334"]
        CertMgr["Certificate Manager\nAuto SSL (ACME webroot)"]
        LogIng["Log Ingestor\nmail_logs producer"]
        IDS["Intrusion Detection\nFail2ban (host-side)"]
    end

    subgraph Storage["Shared Storage"]
        MailDir["/var/mail/vhosts"]
        SSLCerts["/etc/ssl"]
        Logs["/var/log"]
    end

    subgraph Backends["Backend Services"]
        MySQL[(MySQL)]
        Redis[(Redis)]
    end

    Internet -->|"SMTP :25"| Postfix
    Internet -->|"Submission :587/:465"| Postfix
    Internet -->|"IMAP :143/:993"| Dovecot
    Internet -->|"POP3 :110/:995"| Dovecot

    Postfix -->|"LMTP :24"| Dovecot
    Postfix -->|"Milter :11332"| Rspamd
    Postfix -->|"SASL :24100"| Dovecot

    Postfix --> MySQL
    Dovecot --> MySQL
    Rspamd --> Redis

    CertMgr -->|"SIGHUP reload"| Postfix
    CertMgr -->|"SIGHUP reload"| Dovecot

    IDS -->|"reads"| Logs
    LogIng -->|"tails"| Logs
    LogIng -->|"mail_logs rows"| MySQL

    Postfix --> MailDir
    Dovecot --> MailDir
    CertMgr --> SSLCerts

Service Quick Reference¶

How Mail Flows Through the System¶

Understanding the mail flow helps you debug delivery issues and tune performance.

Outbound (your user sends an email)¶

sequenceDiagram
    participant User as Email Client
    participant PF as Postfix :587
    participant DV as Dovecot :24100
    participant RL as rate_limiter :8082
    participant RS as Rspamd
    participant Remote as Remote MTA

    User->>PF: Connect (STARTTLS/TLS)
    PF->>DV: SASL auth check
    DV-->>PF: Auth OK
    PF->>RL: Policy check (DATA phase, via HTTP bridge)
    RL-->>PF: Within limits
    PF->>PF: tracking-filter (pixel + links)
    PF->>RS: DKIM signing + headers (milter)
    RS-->>PF: Signed message
    PF->>Remote: Deliver via SMTP

1. User connects to Postfix on port 587 (STARTTLS) or 465 (implicit TLS). The webmail/API submit on the internal listener 10587 instead.
2. SASL authentication — Postfix delegates to Dovecot on port 24100 to verify credentials against MySQL (mailbox passwords or SMTP API keys).
3. Rate limiting — at DATA phase, rate_limit_policy.py delegates to the rate limiter worker over HTTP; over-quota answers defer with 4.7.1.
4. Content filtering — the tracking injector adds open/click tracking for HTML mail, consults the delivery optimizer, and archives the message.
5. Rspamd milter — signs the email with DKIM, adds authentication headers.
6. Delivery — Postfix hands the email to the remote MTA over SMTP.
7. Logging — the log ingestor turns the resulting log lines into mail_logs rows and email.delivered/bounced/deferred webhooks.

Inbound (someone sends email to your user)¶

sequenceDiagram
    participant Remote as Remote MTA
    participant PF as Postfix :25
    participant RS as Rspamd
    participant DV as Dovecot :24
    participant Store as Maildir Storage

    Remote->>PF: Connect SMTP
    PF->>PF: Postscreen (DNSBL, pregreet)
    PF->>PF: SMTP restrictions (RBL, HELO, sender)
    PF->>RS: Content scan (spam, virus, DKIM)
    RS-->>PF: Score + headers
    PF->>DV: LMTP delivery
    DV->>DV: Sieve filters
    DV->>DV: Quota check
    DV->>Store: Write to Maildir

1. Postscreen filters out spam bots using DNSBL lookups, pregreet detection, and pipelining checks. This alone blocks about 80% of junk.
2. SMTP restrictions — Postfix applies RBL checks, HELO validation, sender/recipient validation.
3. Rspamd milter — full spam analysis: Bayesian filtering, SPF/DKIM/DMARC verification, ClamAV virus scan, phishing detection, neural network scoring.
4. LMTP delivery — Postfix hands the email to Dovecot via LMTP on port 24.
5. Sieve filtering — Dovecot runs per-user and global Sieve scripts (smart folders, vacation replies, etc.).
6. Quota check — Dovecot enforces the mailbox quota. If the user is over quota, the email bounces with a temporary failure.
7. Storage — the email lands in /var/mail/vhosts/{domain}/{user}/ as Maildir.

Shared Infrastructure¶

All mailer services share these backend resources:

Related Sections¶

• Worker Modules — The API, tracking, webhooks, and analytics layer that sits on top of the mailer
• Configuration — Detailed configuration for Postfix, Dovecot, and Rspamd
• Monitoring — Health checks and metrics for all mailer services
• Reference > CLI Commands — Docker exec commands for managing mailer services