mox

Mox is an all-in-one, secure, open-source mail server designed for low-maintenance self-hosting. Key features include:

• Easy Operation: A quickstart process that performs DNS checks, generates configuration files, creates initial admin and email accounts, and provides necessary DNS records. It also provides a systemd unit file for Linux.
• SMTP Support: Includes an SMTP server for incoming messages (port 25), an SMTP client and delivery queue for outgoing messages, and a submission server for authenticated clients.
• Message Authentication: Built-in support for SPF, DKIM, and DMARC to verify domain identity and prevent spoofing.
• Secure Delivery: Supports DANE (requires DNSSEC) and MTA-STS for protecting MX records and verifying TLS certificates during SMTP delivery. It also implements the REQUIRETLS extension.
• IMAP4: Implements up to IMAP4rev2, including extensions like CONDSTORE and QRESYNC for efficient mailbox synchronization.
• Junk Filtering: Uses reputation-based filtering (SPF, DKIM, DMARC) to manage spam.

Mox uses a reputation-based system to filter spam. Reputation is calculated per account and is based on the sender's IP address, email address/domain, and message content.

• Reputation Signals: Messages from known senders (verified via SPF/DKIM/DMARC) or those with established communication history are automatically marked as non-junk.
• First-time Senders: Senders without established reputation undergo Bayesian analysis of message content. The probability of a message being junk must not exceed a configurable threshold.
• Non-junk automation: Moving messages to certain mailboxes like Archive or Trash automatically marks them as non-junk, building positive reputation for that sender.
• Rejects Mailbox: When a message is rejected as junk, Mox stores a copy in a special Rejects mailbox (which is automatically cleaned up). Moving a message from Rejects to the Inbox and marking it as non-junk will establish reputation for that sender.

Mox implements a variety of email, security, and access protocols. Below is a summary of the current implementation status for each protocol topic:

Implemented

• Internet Message Format: The format of email messages.
• SMTP: Delivering email.
• SPF: Message authentication based on sending IP.
• DKIM: Message authentication based on message header.
• DMARC: Reject/accept policy for incoming messages that pass/fail DKIM and/or SPF authentication.
• DANE: Verification of TLS certificates through DNSSEC-protected DNS records.
• MTA-STS: PKIX-based protection of TLS certificates and MX records.
• TLS Reporting: Reporting about TLS interoperability issues.
• IMAP: Email access protocol.
• SASL: Authentication mechanisms.
• Internationalization: Internationalization of domain names.
• TLS: Encrypted and authenticated communication.
• ACME: Automatically manage PKIX TLS certificates.
• CAA: DNS records specifying allowed Certificate Authorities (CAs).
• HTTP: Used for webservers, automatic account configuration, MTA-STS, and the built-in webserver.

Roadmap (Planned)

• ARC: Signed message authentication results from forwarding servers.
• ARF: Abuse reporting format.
• Sieve: Scripts to run on incoming messages.
• JMAP: HTTP/JSON-based email access protocol.
• CalDAV/iCal: Calendaring.
• CardDAV/vCard: Contacts.

Mox does not allow direct file system access to mailboxes (e.g., via Maildir). Email access is strictly provided through protocols like IMAP. This design ensures reliable state management and allows for future features like full-disk encryption.

Storage Details

• Account Isolation: Mox user accounts are independent of OS user accounts. All data is accessible only by the Mox process.
• Message Format: Messages are stored as individual files in standard Internet Message Format (IMF).
• File Path Pattern: data/accounts/<account>/msg/<dir>/<msgid>
  • <msgid> is a unique integer from the per-account index database.
  • <dir> groups 8k consecutive IDs to prevent directory bloat.
• Metadata & Indexing: Metadata (like SMTP remote IP, SPF/DKIM/DMARC status, and generated headers) is stored in a per-account index database located at data/accounts/<account>/index.db. This database uses the bstore library (based on bbolt).

To quickly set up a dedicated mail server for your domain, follow these steps on a dedicated (virtual) machine. It is highly recommended to name the host [host].[domain] (e.g., mail.example.com) and use a DNSSEC-verifying resolver like unbound.

1. Create a dedicated user and home directory (run as root):

   useradd -m -d /home/mox mox
   cd /home/mox

2. Install Mox: Download or compile the binary into /home/mox (see Download/Compiling sections).
3. Generate configuration: Run the quickstart command with your target email address:

   ./mox quickstart you@example.com

What the quickstart does:

• Creates mox.conf and domains.conf.
• Adds your domain and email account to domains.conf.
• Generates admin and account passwords.
• Prints required DNS records for the machine and domain.
• Prints commands to start Mox or install it as a service.

Note on Webservers: Mox requires a webserver for automatic TLS with ACME. If your machine doesn't have one, you can use the webserver built into Mox. If you already run a webserver on port 443/80, refer to mox help quickstart for configuration instructions.

To set up Mox for a new domain, follow these steps on a dedicated (virtual) machine named [host].[domain] (e.g., mail.example.com). It is highly recommended to have a DNSSEC-verifying resolver like unbound installed.

1. Create a dedicated mox user and home directory.
2. Download or compile the mox binary into that directory.
3. Run the quickstart command with your primary email address.

The quickstart command performs the following:

• Creates mox.conf and domains.conf.
• Adds the domain and an account for the specified email to domains.conf.
• Generates admin and account passwords.
• Prints required DNS records for the machine and domain.
• Prints commands to start Mox and optionally install it as a service.

Note on Webservers: Mox requires HTTPS for automatic TLS with ACME. It is recommended to use a machine that does not already run a webserver, or use the webserver built into Mox. If you must run an existing webserver on ports 443/80, refer to mox help quickstart.

# Create mox user and homedir
useradd -m -d /home/mox mox

cd /home/mox
# ... compile or download mox to this directory ...

# Generate config files for your address/domain
./mox quickstart you@example.com

Mox includes a built-in, configurable webserver used for MTA-STS, automatic account configuration, webmail, and the admin interface. It supports the following handler types:

• Redirections: Redirect entire domains (WebDomainRedirects) or specific paths (WebHandlers-dash-WebRedirect).
• Static Files: Serve files from a directory (WebHandlers-dash-WebStatic), with optional directory listings.
• Forwarding/Reverse Proxying: Forward requests, including WebSocket connections (WebHandlers-dash-WebForward).

Incoming requests are matched based on Host and Path (using regular expressions). Handlers can also:

• Automatically redirect plain HTTP to HTTPS.
• Automatically compress responses based on content-type.
• Strip the matched path before serving static files or forwarding.
• Add custom headers to the response.

TLS certificates for configured domains are managed automatically if ACME is configured. If running Mox alongside an existing webserver, you must manually manage TLS certificates, configure paths to TLS-KeyCerts, and use the -existing-webserver option during quickstart.