SinonMail is a self-hosted enterprise mail server that implements SMTP, IMAP, POP3, CalDAV and CardDAV natively, not a gateway bolted onto someone else's MTA. Every message stays on infrastructure you control, and every administrative action lands in a hash-chained audit log you can verify yourself.
Self-host or SinonTech-hosted. Hierarchical tenants. Air-gap capable.
Native SinonMail clients. The macOS and Linux desktop apps are available now in alpha; Windows, iOS and Android are on the way. Contact us to join the alpha.
Features
Across eight categories: mail, security, DLP, classification, migration, collaboration, compliance, and integrations.
Protocols Implemented
SMTP, IMAP, POP3, CalDAV and CardDAV, each a first-class server rather than a proxy.
API Routes
REST API across public, authenticated and admin tiers, plus a separate SCIM 2.0 surface.
Background Workers
Outbound delivery, bounce processing, DKIM rotation, DLP quarantine, retention, replication, and spam training.
Deployment Modes
Bare metal, Docker, Kubernetes, cloud VMs, virtual environments, and fully air-gapped.
Most self-hosted mail is an assembly job: Postfix for SMTP, Dovecot for IMAP, SpamAssassin bolted on, Radicale for calendars, and a webmail client stitched over the top, five config languages and no shared audit trail. SinonMail implements the protocol servers itself, against one schema, with one permission model.
Inbound listener on port 25 and authenticated submission on 587, with a dedicated delivery pipeline handling queuing, retries, and bounce processing. Outbound delivery and bounce handling each run as their own background workers.
IMAP on 143 with STARTTLS and 993 with implicit TLS, including IDLE for push. POP3 on 110 and 995. Any standard client works: Outlook, Apple Mail, Thunderbird, mobile.
Calendars and contacts served natively, with free/busy lookup. No separate groupware server to run, patch, and reconcile against your mail identities.
DKIM signing and verification with automated key rotation as a scheduled worker. SPF checking and DMARC evaluation on inbound mail. Deliverability is configuration, not an afterthought.
End-to-end encryption with PGP/MIME wired into the SMTP path, S/MIME support, key management, and a tenant-scoped public-key directory so senders can find recipient keys internally.
A React webmail client ships with the platform: rich-text composition, calendars, and contacts. Per-tenant webmail domains with SNI TLS mean each tenant gets its own branded hostname.
Mail is where the sensitive data actually lives. SinonMail treats that as the design problem rather than an add-on module.
Administrative actions are recorded into a hash-chained, append-only audit log. Each entry links to the one before it, so removing or editing a record breaks the chain and the tampering is detectable rather than silent.
The most developed subsystem in the platform: policies, rules, and templates with a built-in pattern library, violation tracking, and a quarantine worker. Document fingerprinting catches known-sensitive content, and the archive scanner looks inside attachments rather than trusting the filename.
Classification levels, rules and templates, with send restrictions that act on the classification. Mail marked at a given level can be blocked from leaving the tenant automatically.
A Bayesian filter with a dedicated training worker, header analysis, and a SpamAssassin client. ClamAV integration scans attachments for malware on the way through.
A dedicated ransomware scanner with its own quarantine path and configurable policy service, not a generic AV rule but a separate subsystem with its own schema.
An Exchange-style transport rules engine for mail-flow policy, plus retention policies enforced by a scheduled worker. Familiar concepts, without the Windows licensing.
The reason organisations stay on hosted mail is rarely the product. It is the migration. SinonMail ships importers for the formats you are actually stuck in, not just the convenient ones.
Exchange Web Services (EWS) and Microsoft Graph importers pull mailboxes directly from Exchange and Microsoft 365. PST import handles the archives sitting on staff laptops.
IMAP, mbox and Maildir importers cover Google Workspace, Dovecot, and effectively any conventional mail system.
Your mail sits in PostgreSQL with a filesystem or S3 message store. There is no proprietary container and no export window, so leaving is a decision, not a negotiation.
Tenants nest. A tenant can own sub-tenants, which makes SinonMail workable for an MSP running mail for many clients, or a group running mail for many subsidiaries, not just for one flat organisation.
Branding, licensing, rate-limit overrides, feature overrides, and webmail domains with SNI TLS are all set per tenant. Tenant identity is resolved in middleware and enforced through the repository layer on every query.
Single sign-on through OIDC and SAML 2.0, with SCIM 2.0 for automated user provisioning and de-provisioning. Pairs directly with SinonAuth, or with whatever identity provider you already run.
Multi-server replication with push and pull services, peer management, lag reporting, snapshots, and promote/demote. Per-tenant backup policies run on a scheduler with pluggable destinations.
Every protocol server, the API, and the workers can scale independently. The Helm chart ships separate deployments for API, IMAP, POP3, inbound SMTP, outbound SMTP, CalDAV and workers, with horizontal pod autoscaling and pod disruption budgets.
An installer with systemd units and helper scripts for nginx, TLS, Redis and ClamAV. An operations CLI handles day-two tasks.
Compose files for development and production, with PostgreSQL 16 and Redis 7 alongside an nginx front end.
A Helm chart with per-component deployments, autoscaling, ingress, and a persistent volume claim for the mail store.
AWS, Azure, GCP, or any provider that gives you a Linux box. The bare-metal installer does not care whose hardware it is.
VMware, Hyper-V, Proxmox: standard virtualisation, no special casing.
A dedicated air-gap installer and a bundle packager for networks with no outbound route at all. Mail keeps working with no path to the internet.
| Mail protocols | SMTP (25 inbound, 587 submission), IMAP (143 STARTTLS, 993 TLS, with IDLE), POP3 (110, 995) |
|---|---|
| Groupware protocols | CalDAV (5232) with free/busy, CardDAV |
| Mail authentication | DKIM signing, verification and key rotation; SPF checking; DMARC evaluation |
| Encryption | OpenPGP, PGP/MIME, S/MIME, tenant-scoped public-key directory, encryption at rest |
| Identity | OIDC and SAML 2.0 single sign-on, SCIM 2.0 provisioning, JWT sessions, role-based access |
| Filtering | Bayesian anti-spam with training worker, header analysis, SpamAssassin client, ClamAV antivirus, Sieve-style user filters |
| Databases | PostgreSQL 16 (53 migrations), Redis 7 for queues and caching |
| Message storage | Filesystem or S3-compatible object store |
| API | 62 route modules across public, authenticated and admin tiers; separate SCIM 2.0 API |
| Multi-tenancy | Hierarchical parent/child tenants, per-tenant branding, licensing, feature and rate-limit overrides, webmail domains with SNI TLS |
| Migration sources | IMAP, mbox, Maildir, Exchange Web Services, Microsoft Graph, PST |
| Backend stack | TypeScript on Node.js (ESM), Express, Zod validation, BullMQ queues, Pino logging, WebSockets |
| Webmail stack | React 18 with Vite, Redux Toolkit, TanStack Query, Tailwind CSS |
| Deployment | Bare metal (systemd), Docker Compose, Kubernetes (Helm, HPA, PDB), cloud VMs, virtual environments, air-gapped |
| Operations | Control CLI, background workers for delivery, bounces, DKIM rotation, DLP quarantine, retention, replication and spam training |
A self-hosted enterprise mail server. It implements SMTP, IMAP, POP3, CalDAV and CardDAV natively, ships a React webmail client, and adds the things organisations actually get audited on: data loss prevention with document fingerprinting, data classification with send restrictions, a tamper-evident audit log, ransomware scanning, and Exchange-style transport rules. It runs on PostgreSQL and Redis on your own infrastructure.
A full mail server. The SMTP, IMAP and POP3 listeners are implemented in the platform itself, with their own delivery pipeline, queuing and bounce handling. You are not running Postfix and Dovecot underneath with a management layer on top. There is one schema, one permission model, and one audit trail across every protocol.
Yes. SinonMail ships importers for Exchange Web Services and Microsoft Graph, so mailboxes can be pulled directly from Exchange or Microsoft 365, and a PST importer for the archives that live on laptops. IMAP, mbox and Maildir importers cover Google Workspace, Dovecot and most other systems. Migration tooling is part of the platform rather than a professional-services engagement.
Yes. Because the protocols are standard IMAP, POP3, SMTP submission, CalDAV and CardDAV, any conventional client connects, including Outlook, Apple Mail, Thunderbird, iOS and Android. Staff who prefer webmail can use the included React client instead.
Tenants are hierarchical: a tenant can own sub-tenants, so an MSP can run mail for many clients, or a group for many subsidiaries. Tenant identity is resolved in middleware and enforced through the repository layer on every database query. Branding, licensing, feature toggles, rate limits and webmail domains (with SNI TLS) are all configured per tenant.
Yes. There is a dedicated air-gap installer and a bundle packager for networks with no outbound route. Internal mail, calendars, contacts, DLP, classification and the audit log all function with no path to the internet. Inbound and outbound internet mail obviously requires a route to the internet. That is a property of email, not of SinonMail.
It is hash-chained and append-only. Each entry incorporates a hash of the previous one, so the log forms a chain: deleting or editing an entry after the fact breaks it, and the break is detectable. A conventional log table can be quietly edited by anyone with database access, which is precisely the scenario an auditor asks you about.
Closed beta. The platform is substantially implemented: the protocol servers, DLP, classification, encryption, migration tooling, replication and the audit log all exist as working code with 53 database migrations behind them. Request access and we will walk you through the architecture and deployment before you commit anything.
SinonMail is in closed beta. Request access for deployment documentation, an architecture walkthrough, and priority onboarding.
Talk to an engineer about running SinonMail on your own infrastructure, or let us host it for you and still own every byte.