One mail platform that filters, hosts, sends, and routes.

Built

Receiving, queueing, and delivery

• An SMTP receiver that stores each message durably before it acknowledges it.
• A queue with retries, relay delivery, and bounce generation.
• SPF, DKIM, and DMARC checks on inbound mail.

Filtering

• A staged filter pipeline with rate limits, DNS blocklists, reverse DNS checks, and greylisting.
• Adapters for Rspamd and ClamAV.
• Recipient checks against Google, Microsoft, LDAP, and SCIM directories.
• Quarantine with digest emails.
• Lookalike-domain and impersonation detection, and URL rewriting with click-time checks.

Relay to Google Workspace and Microsoft 365

• Filter mail, then relay it onward with ARC and loop prevention.
• A smarthost mode for Google, Microsoft, and internal systems.

Policy and explanation

• Policies written as code in CEL, with lint and test commands.
• A new policy can be replayed against historical traffic, then rolled out in stages with signed bundles.
• Every message gets a per-stage trace, and the trace view shows what would have changed the outcome.
• A mail flow simulator, and a shadow mode that compares verdicts with your current gateway.

Sending

• Tenants, projects, and service accounts, with API keys and SMTP credentials.
• Authenticated SMTP submission and a REST send API with idempotency and batch sending.
• Per-domain DKIM with automated key rotation.
• Sending domains, templates, signed webhooks, open and click tracking, quotas, and one-click unsubscribe.

Deliverability controls

• IP pools, outbound routing, and IP warm-up.
• Per-provider throttling and retry policies.
• Reputation scoring with automatic protection.
• Bounce handling and suppression lists.
• Routing through upstream relays such as SES, SendGrid, and Mailgun.
• Detection of unusual outbound volume, with automatic throttling of compromised accounts.

Mail hosting

• Mailboxes with quotas, deduplication, compression, full-text search, and encryption at rest.
• Sign-in with passwords, app passwords, TOTP, WebAuthn, OIDC, or LDAP.
• Sieve filters, aliases, shared mailboxes, delegation, vacation replies, and forwarding.
• JMAP, and POP3 if you turn it on.

Admin console and operations

• A web console with message trace, quarantine, a policy workbench, and sending dashboards.
• A cutover wizard with DNS health monitoring.
• Multiple tenants with roles, single sign-on over OIDC and SAML, and MSP branding.
• Prometheus and OpenTelemetry metrics, Grafana dashboards, and alert rules.
• A local dev mode that catches mail in a sink.

Compatibility, identity, and extras

• An API and SMTP interface modeled on SES.
• Importers for SES, ZeptoMail, Barracuda ESG, SpamTitan, and Postfix and Exim maps.
• Keyless workload identity, inbound routes and parsing for applications, and optional address verification.
• An S/MIME and PGP gateway and a DMARC report analyzer.
• An optional local classifier that stays off unless you enable it.