Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box.
Please see https://mailinabox.email for the project's website and setup guide!
I am trying to:
- Make deploying a good mail server easy.
- Promote decentralization, innovation, and privacy on the web.
- Have automated, auditable, and idempotent configuration.
- Not make a totally unhackable, NSA-proof server.
- Not make something customizable by power users.
This setup is what has been powering my own personal email since September 2013.
Mail-in-a-Box turns a fresh Ubuntu 14.04 LTS 64-bit machine into a working mail server by installing and configuring various components.
It is a one-click email appliance (see the setup guide). There are no user-configurable setup options. It "just works".
The components installed are:
- SMTP (postfix), IMAP (dovecot), CardDAV/CalDAV (ownCloud), Exchange ActiveSync (z-push)
- Webmail (Roundcube), static website hosting (nginx)
- Spam filtering (spamassassin), greylisting (postgrey)
- DNS (nsd4) with SPF, DKIM (OpenDKIM), DMARC, DNSSEC, DANE TLSA, and SSHFP records automatically set
- Firewall (ufw), intrusion protection (fail2ban), system monitoring (munin)
It also includes:
- A control panel and API for adding/removing mail users, aliases, custom DNS records, etc. and detailed system monitoring.
- Our own builds of postgrey and dovecot-lucene distributed via the Mail-in-a-Box PPA on Launchpad.
For more information on how Mail-in-a-Box handles your privacy, see the security details page.
See the security guide for more information about the box's security configuration (TLS, password storage, etc).
I sign the release tags on git. To verify that a tag is signed by me, you can perform the following steps:
# Download my PGP key. $ curl -s https://keybase.io/joshdata/key.asc | gpg --import gpg: key C10BDD81: public key "Joshua Tauberer <firstname.lastname@example.org>" imported # Clone this repository. $ git clone https://github.com/mail-in-a-box/mailinabox $ cd mailinabox # Verify the tag. $ git verify-tag v0.10 gpg: Signature made ..... using RSA key ID C10BDD81 gpg: Good signature from "Joshua Tauberer <email@example.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 5F4C 0E73 13CC D744 693B 2AEA B920 41F4 C10B DD81
This project was inspired in part by the "NSA-proof your email in 2 hours" blog post by Drew Crawford, Sovereign by Alex Payne, and conversations with <a href="http://twitter.com/shevski" target="_blank">@shevski</a>, <a href="https://github.com/konklone" target="_blank">@konklone</a>, and <a href="https://github.com/gregelin" target="_blank">@GregElin</a>.
- In 2007 I wrote a relatively popular Mozilla Thunderbird extension that added client-side SPF and DKIM checks to mail to warn users about possible phishing: add-on page, source.
- In August 2013 I began Mail-in-a-Box by combining my own mail server configuration with the setup in "NSA-proof your email in 2 hours" and making the setup steps reproducible with bash scripts.
- Mail-in-a-Box was a semifinalist in the 2014 Knight News Challenge, but it was not selected as a winner.
- Mail-in-a-Box hit the front page of Hacker News in April 2014, September 2014, and May 2015.