deeztek/Hermes-Secure-Email-Gateway

<p align="center"> <a href="https://www.hermesseg.io"> <img alt="Hermes SEG logo" title="Hermes Secure Email Gateway" src="docs/images/hermes-logo-mark.png" width="120"> </a> </p>

<h1 align="center">Hermes Secure Email Gateway and Email Server</h1>

<p align="center"> <strong>Self-hosted email security, mail server, and Nextcloud — one stack, one Docker Compose file.</strong><br> Open-source spam &amp; malware filtering, S/MIME &amp; PGP encryption, DKIM/DMARC/ARC, mailboxes, webmail, and SSO.<br> Pro adds time-of-click link protection — the inbound-link defense you'd otherwise pay Proofpoint or Mimecast for. </p>

<p align="center"> <a href="https://www.hermesseg.io/features/">Features</a> &middot; <a href="https://www.hermesseg.io/pro/">Pro</a> &middot; <a href="https://www.hermesseg.io/pricing/">Pricing</a> &middot; <a href="https://docs.deeztek.com/shelves/hermes-seg-docker">Docs</a> &middot; <a href="https://www.hermesseg.io/support/">Support</a> </p>

<p align="center"> <a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/releases"><img alt="Latest pre-release" src="https://img.shields.io/github/v/release/deeztek/Hermes-Secure-Email-Gateway?include_prereleases&label=pre-release&color=ee6c2b"></a> <a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/deeztek/Hermes-Secure-Email-Gateway?style=social"></a> <a href="https://www.gnu.org/licenses/agpl-3.0.html"><img alt="License: AGPL v3" src="https://img.shields.io/badge/license-AGPLv3-blue.svg"></a> <a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/issues"><img alt="GitHub issues" src="https://img.shields.io/github/issues/deeztek/Hermes-Secure-Email-Gateway?color=586069"></a> <a href="https://matrix.to/#/#hermesseg:matrix.org"><img alt="Matrix" src="https://img.shields.io/badge/matrix-%23hermesseg%3Amatrix.org-0DBD8B?logo=matrix&logoColor=white"></a> <a href="https://t.me/HermesSEG"><img alt="Telegram" src="https://img.shields.io/badge/telegram-HermesSEG-26A5E4?logo=telegram&logoColor=white"></a> </p>

<p align="center"> <em> Deployable as a gateway in front of Microsoft 365 / Google Workspace / Exchange, as a full mail server with built-in mailboxes, or in hybrid mode. </em> </p>

<!-- Screenshots row. Add these PNGs under docs/images/screenshots/ in the repo, or replace the src URLs with absolute hermesseg.io / imgur URLs if you prefer to keep binaries out of git history. --> <p align="center"> <img alt="Admin Dashboard" src="docs/images/screenshots/dashboard.png" width="32%"> &nbsp; <img alt="Message History" src="docs/images/screenshots/message-history.png" width="32%"> &nbsp; <img alt="Organizational Signatures" src="docs/images/screenshots/organizational-signatures.png" width="32%"> </p>

---

Table of contents

• About
• Editions
• Features
• Architecture
• Storage topology
• Requirements
• Installation
• Updating
• Configuration
• Recovery and maintenance tools
• Documentation
• Support
• License

---

About

Hermes Secure Email Gateway is a Free Open Source Secure Email Gateway and Email Server.

It provides spam, virus, and malware protection through Apache SpamAssassin, ClamAV, and Amavisd-new; full in-transit and at-rest email encryption via SMTP TLS, S/MIME, PGP, encrypted PDF (powered by CipherMail), and Dovecot mail-crypt; email archiving; integrated mailbox hosting on Dovecot with per-user quotas, aliases, shared folders, Sieve rules, vacation auto-reply, and mobile-device autoconfiguration; file sync, webmail, calendars (CalDAV), and contacts (CardDAV) through Nextcloud; a local user directory and single sign-on via OpenLDAP and Authelia &mdash; with multi-factor authentication via TOTP, WebAuthn, and Duo Push; and modern email authentication standards including SPF, DKIM signing and verification, DMARC, and ARC through OpenDKIM, OpenDMARC, and OpenARC.

Hermes combines these Open Source technologies under one unified web-based administration console for easy management of your organization's inbound and outbound email, mailbox users, encryption keys, and authentication policies. End users get a self-service portal for managing their own signatures, sieve rules, vacation messages, app passwords, and mobile-device profiles.

Hermes can be deployed three ways:

• As a gateway in front of an existing mail solution (in-house Exchange / Postfix, Google Workspace, Microsoft 365). Hermes scans, filters, encrypts, and relays mail to your backend.
• As a full mail server with built-in mailbox hosting, webmail, file sync, calendars, and contacts. No external mail backend required.
• As a hybrid &mdash; gateway for some domains AND mail server for others on the same install. Relay (gateway) domains and mailbox (mail server) domains coexist in a single Hermes deployment.

This Docker Edition packages the entire stack as a set of containers managed by Docker Compose, replacing the legacy bare-metal Ubuntu installer with a portable, reproducible deployment.

Looking for a managed version? Hermes is self-hosted by design. If you want to support development and get vendor support, see Pro pricing &mdash; per-server licensing, no per-mailbox fees.

Editions

Hermes ships in two editions:

| Edition | License | What you get | |---|---|---| | Community | AGPL v3 &mdash; free, open source | The entire mail gateway and email server stack. All core security, encryption, mailbox hosting, and administration features. | | Pro | Commercial &mdash; see EULA | Everything in Community plus 6 advanced features (see Pro Features below). Pricing &rarr; |

A Pro license is purchased separately. Community Edition needs no license file and works fully without one.

The project is licensed under AGPLv3 (`LICENSE`); a small set of proprietary Pro Edition files are excluded from the AGPL grant and governed by the Pro EULA. See `LICENSING.md` for the authoritative breakdown — the per-file header controls which license applies.

Features

A condensed list. See hermesseg.io/features for the full feature page with screenshots.

Mail security (Community)

• Spam protection (Apache SpamAssassin, postscreen, RBL configuration, sender/recipient/network block-allow lists, global sender filters)
• Anti-virus protection (ClamAV via Amavisd-new, with built-in feeds: ClamAV official + URLhaus)
• Malware feeds management (managed via Fangfrisch) &mdash; configure additional 3rd-party signature feeds including SaneSecurity, MalwarePatrol, SecuriteInfo, TwinWave, ClamPunch, RFXN, InterServer, Ditekshen, and more
• Per-recipient spam/virus/file policies
• Custom message rules, score overrides, custom file expressions/extensions/rules
• Quarantine, message-history search, queue management, train as spam/ham, release to recipient, download messages

Encryption and authentication (Community)

• In-transit email encryption: SMTP TLS, S/MIME, PGP (via CipherMail)
• At-rest encryption: Dovecot mail crypt
• Encrypted PDF email for recipients without S/MIME or PGP
• Multi-factor authentication (Authelia): TOTP, WebAuthn, Duo Push
• Local LDAP user store (built-in OpenLDAP) for admins, mailbox users, and relay users
• App passwords for SMTP / IMAP / DAV clients (separate from main account password)
• Free Let's Encrypt (ACME) TLS certificates &mdash; automated issuance and auto-renewal for the admin console and per mailbox domain (SAN), plus import/CSR support for 3rd-party certificates
• haveibeenpwned password check integration

Email standards (Community)

• SPF check, DKIM check + sign, DMARC verification (OpenDMARC)
• ARC (Authenticated Received Chain) signing and verification (OpenARC) &mdash; preserves authentication results across trusted forwarders
• DKIM key generation and management (UI)
• Multi-instance OpenDKIM for differential outbound-sign vs inbound-verify behavior
• DMARC report aggregation and reporting

Email server / mailbox hosting (Community)

• Local mailbox hosting (Dovecot 2.4) with IMAPS / POP3S / Submission (587/465) / LMTP
• Per-domain and per-mailbox quotas
• Mailbox aliases and forwarders
• Shared mailboxes and shared folders
• User-defined Sieve rules
• Vacation auto-reply with date scoping and per-address filtering
• Mobile device autoconfiguration via signed .mobileconfig profiles (iOS) and CalDAV/CardDAV autodiscovery
• Personal email signatures (rich HTML, with template gallery)
• External Sender Banner (inbound mail from outside the org gets a visual banner)

Nextcloud integration (Community)

• File sync (Nextcloud Files)
• Webmail (Nextcloud Mail)
• Calendars (CalDAV) and contacts (CardDAV)
• Single sign-on via Authelia OIDC
• Pre-provisioning of Nextcloud user accounts on first login

Admin and user experience (Community)

• Modern AdminLTE 4 / Bootstrap 5 administrator console
• User self-service portal (per-mailbox)
• Real-time dashboard with system-resource monitoring
• Message statistics with visual charts
• Scheduled tasks UI (DB-backed Ofelia job management)
• Searchable system event logs
• Internal CA management (S/MIME)
• DNS resolver (Unbound, local-recursive)
• Console host and domain management

Pro features

Pro Edition adds the following capabilities on top of everything in Community. Full Pro feature page &rarr;

| Pro Feature | What it does | |---|---| | Email disclaimers | Per-domain outbound disclaimer templates, applied at the milter level. Form-based template renderer with reusable templates. | | Organizational signatures | Centrally-managed per-domain employee signature templates with placeholder substitution (employee name, title, phone, email, department, organization info). Renders on every outbound message. Community Edition has Personal Signatures (per-user, free-form) only. | | Intrusion Prevention (IPS) | Web UI for managing Fail2ban jails, ban thresholds, ban duration, whitelists. Real-time view of active bans. | | Console firewall | Web UI for managing the host firewall protecting the admin console (port allowlisting, source-IP restriction). | | LDAP RemoteAuth | Per-domain pass-through authentication to one or more external LDAP servers (including Microsoft Active Directory). End users authenticate against your existing directory; Hermes provisions mailboxes on first successful login. Supports STARTTLS and LDAPS. | | Link Guard | Time-of-click URL protection for inbound mail — comparable to Microsoft Safe Links and Proofpoint URL Defense. Links are rewritten to a Hermes redirect and the destination's reputation is checked at the moment the user clicks &mdash; catching links weaponized after delivery. Layered verdicts (heuristics + URLhaus / OpenPhish blocklist feeds + optional Google Safe Browsing / VirusTotal), open-redirect detection, an operator-managed list of abused cloud-storage / redirector hosts, and optional guarded redirect-chain following. Admin-configurable per-tier actions and outbound link restoration. Runs in-stack or on a separate host. |

Architecture

Hermes SEG Docker Edition runs as 19 containers orchestrated by Docker Compose:

| Container | Purpose | |---|---| | hermes_unbound | Recursive DNS resolver for the stack | | hermes_db_server | MariaDB &mdash; Hermes, Authelia, Nextcloud, OpenDMARC, CipherMail, Syslog datab