Security¶

An email server is a high-value target. It handles credentials, private communications, and is directly exposed to the internet. This section documents how Mailyte is secured and how to keep it that way.

Every control documented in this section is one that actually executes in the deployed code or configuration. Where a capability exists as code but is not wired into the mail path, that status is stated explicitly — a documented control that does not run is worse than no documentation at all.

In this section¶

Threat Model¶

Mailyte faces threats from the internet and from misconfiguration. Here's how the defense layers map to the attack surface:

graph TB
    subgraph "External Threats"
        SPAM[Spam Floods]
        BRUTE[Brute Force Login]
        EXPLOIT[Service Exploits]
        RELAY[Open Relay Abuse]
        PHISH[Phishing Campaigns]
    end

    subgraph "Defense Layers"
        FW[Firewall + loopback-only bindings]
        AP[Dovecot auth-policy server]
        RSPAMD_D[Rspamd Filtering]
        TLS_D[TLS Encryption]
        AUTH[Authentication]
        ISO[Tenant Isolation]
    end

    subgraph "Internal"
        DATA[(Data at Rest)]
        COMMS[Inter-Service Comms]
    end

    SPAM --> RSPAMD_D
    BRUTE --> AP
    EXPLOIT --> FW
    RELAY --> AUTH
    PHISH --> RSPAMD_D
    FW --> TLS_D
    TLS_D --> AUTH
    AUTH --> ISO
    ISO --> DATA
    ISO --> COMMS

Defense Layers¶

Layer 1: Network¶

Only mail ports (25/465/587, 143/993, 110/995) and web ingress (80/443 via Traefik) are published to the internet. Since 2026-08-22, docker-compose.prod.yml republishes every internal service — including previously world-reachable, unauthenticated Prometheus (9090) and Qdrant (6333) — on 127.0.0.1 only.

See: Network Security

Layer 2: Transport Encryption¶

External connections use TLS 1.2+. SMTP supports STARTTLS (25/587) and implicit TLS (465), and Postfix refuses AUTH on unencrypted connections (smtpd_tls_auth_only = yes). Dovecot sets ssl = required with ssl_min_protocol = TLSv1.2. HTTP APIs are fronted by Traefik with TLS.

See: Encryption

Layer 3: Authentication¶

API requests require an X-API-Key credential (or an operator/mailbox session). SMTP submission requires SASL authentication against Dovecot (bcrypt password hashes). Domain-scoped SMTP API-key credentials with instant revocation went live 2026-08-27. Invalid API-key attempts are rate-limited per IP.

See: Authentication

Layer 4: Authorization¶

Credentials carry a scope — organization (tenant) or platform (staff) — and platform routes are unreachable for tenant credentials regardless of their permission flags (ADR-002). Organization scope is forced onto tenant queries server-side.

See: Authorization

Layer 5: Spam and Abuse Prevention¶

Rspamd filters inbound email (Bayesian, DNSBL, SPF/DKIM/DMARC, greylisting, phishing checks). Postfix enforces per-client connection/rate limits (anvil) plus two live policy services: per-org submission rate limits and per-org IP allowlists. The Dovecot auth-policy server applies progressive delays and blocks brute-force sources.

See: Intrusion Detection

Layer 6: Monitoring and Detection¶

Failed logins land in failed_auth_attempts (with block/unblock APIs), admin and auth events in audit_logs, and mail flow in mail_logs/delivery_events (since 2026-08-22). Prometheus and the monitoring service track service health and resource pressure.

See: Security Monitoring

Security capabilities¶

Most common security tasks¶

Reporting Security Issues¶

If you discover a security vulnerability, please report it responsibly. Do not open a public issue.

Email: security@mailyte.com

See SECURITY.md in the repository root for the full policy, including the current accepted-risk register.

Related sections¶

• Architecture -- understand the security model in context
• Getting Started -- secure setup from the start
• Features -- security-relevant features like rate limiting and anti-spam
• Development -- security practices for contributors