Haseeb ArshadHaseeb Arshad
← All projects
Internet-facing infrastructureProduction

Self-Hosted Mail Platform with Public SMTP Edge

A multi-domain mail system with a highly available core, hardened public relay, webmail, authenticated submission, and end-to-end delivery verification.

StalwartPostfixWireGuardCloudNativePGRoundcubeDKIM

4

hosted domains

3

mail-core replicas

100%

import hash match

The challenge

What the system needed to solve

Host reliable mail behind a residential connection where inbound SMTP is filtered, without sacrificing TLS identity, queue durability, anti-abuse controls, or recoverability.

The build

Engineering decisions

01

Built a three-replica Stalwart service backed by highly available PostgreSQL and coordination services, with redundant Roundcube webmail.

02

Hardened a small public Postfix edge that queues inbound mail and relays it through an outbound-initiated WireGuard tunnel.

03

Configured SPF, DKIM, DMARC, authenticated submission, automatic client discovery, and protocol-specific TLS monitoring.

04

Migrated legacy mailboxes and independently exported the destination data to verify byte-for-byte message and attachment integrity.

Architecture

How the pieces connect

  1. 1Internet mail servers and clients
  2. 2Hardened SMTP edge
  3. 3WireGuard transport
  4. 4Stalwart HA core
  5. 5PostgreSQL, webmail, and forwarding

Results

What changed

  • Inbound and outbound delivery pass with aligned SPF, DKIM, and DMARC.
  • The public edge absorbs connection and home-network interruptions through persistent queueing.
  • Mailbox migration was validated with counts, roles, blob lengths, and cryptographic hashes rather than spot checks.