How it's built
The system runs on two machines, both dedicated servers in Warsaw: a public-facing edge that handles public traffic, and a mail host that runs the whole stack in Docker and never takes a mail connection from the open internet.
The two machines
The edge
A separate public-facing machine in Warsaw reachable as mail.mailed.pl. It runs only nftables and WireGuard. Public SMTP on 25, 465 and 587 and IMAP on 143 and 993 are forwarded (DNAT) over WireGuard to the mail host without SNAT, so the real client IP is preserved. Outbound SMTP leaves via the edge IP. It stores no mail and runs no Docker.
Public facing. No mail is stored here.
The mail host
One machine running the whole stack in Docker: Postfix, Dovecot, Rspamd, ClamAV, Olefy, Unbound, Redis, PostgreSQL and the control plane. It has no public mail ports; mail reaches it only through the edge, over WireGuard. The control-plane API is reached only through an outbound-only Cloudflare Tunnel.
No public mail ports.
Why we don't mask the sending IP
Most reverse proxies rewrite the source address of every connection they forward. When that happens, Postfix and Rspamd only ever see the proxy's address, not the sender's. SPF checks and spam filters end up working against the wrong IP, which causes both false positives and false negatives.
The edge forwards inbound connections without SNAT, so the real client address reaches Postfix and Rspamd unchanged. That keeps SPF, DNSBLs and fail2ban accurate. Postfix runs postscreen with DNSBL scoring against Spamhaus ZEN, Barracuda and SpamCop before a message is accepted. Outbound SMTP leaves only through the edge, SNAT'd to the edge IP.
How the mail host is locked down
A few things we hold ourselves to:
- No public mail ports. The mail host answers nothing from the open internet. Mail arrives only through the edge over WireGuard, and the API only through an outbound-only Cloudflare Tunnel.
- Encryption at rest. Customer PII and DKIM private keys are encrypted with AES-256-GCM through a KMS service. Master keys are held only in memory, never written to disk.
- Tenant isolation. PostgreSQL row-level security keeps one customer's rows invisible to another, and email lookups use an HMAC blind index rather than the raw address.
- Process isolation. The mail plane and control plane run as separate containers on separate Docker networks; the API never touches mail content.
Company and GDPR
Mailed is built for Polish law and the GDPR (RODO). As the platform grows, mail, storage and control-plane roles move onto additional dedicated nodes in Warsaw. All infrastructure is hosted on dedicated servers in Warsaw, and mail, mailboxes and databases are stored only in Warsaw and never leave the EU, including as the platform scales. See the security notes for how deletion and the 30-day grace period work.