yaat/striptrack repository overview

⁠Striptrack

Striptrack is a lightweight Postfix milter written in Rust that sanitizes inbound HTML emails by removing common tracking elements before delivery.

It is built for operators who want a pragmatic mail processing component that is:

• easy to deploy
• easy to audit
• small in scope
• operationally observable

⁠Why Striptrack

Many HTML emails include remote resources used for open tracking, invisible rendering, or message fingerprinting. Striptrack sits on the mail path and removes the most common high-signal tracking patterns.

The current implementation focuses on:

• tiny remote images used as tracking pixels
• blocked image or embed domains
• hidden HTML blocks used for preview tracking or invisible content
• suspicious dimensions declared directly in HTML or through inline CSS

⁠Key features

• Tracking pixel removal for image sizes from 0x0 to 3x3
• Domain-based filtering for images, iframes, embeds, and related remote content
• Subdomain matching for blocked domains
• Detailed logging of modified messages in SQLite
• Usage statistics and recent log inspection
• Log purge operations by day, by month, or globally
• Built-in HTTP API documentation exposed at GET /doc
• CLI + HTTP API for operations

⁠Default ports

• 12366 — milter
• 8366 — HTTP API

⁠Environment variables

• STRIPTRACK_DB_PATH — SQLite database path
• STRIPTRACK_MILTER_BIND — milter listen address
• STRIPTRACK_API_BIND — HTTP API listen address
• STRIPTRACK_API_ENABLED — enable or disable the HTTP API (true, false, 1, 0)

⁠Example

docker run -d \
  --name striptrack \
  -p 12366:12366 \
  -p 8366:8366 \
  -e STRIPTRACK_DB_PATH=/data/striptrack.db \
  -e STRIPTRACK_MILTER_BIND=0.0.0.0:12366 \
  -e STRIPTRACK_API_BIND=0.0.0.0:8366 \
  -v striptrack-data:/data \
  striptrack:latest

⁠HTTP API

Core endpoints:

• GET /health
• GET /doc
• GET /domains
• POST /domains
• DELETE /domains/{domain}
• GET /stats
• GET /logs
• DELETE /logs
• DELETE /logs/day/{YYYY-MM-DD}
• DELETE /logs/month/{YYYY-MM}

⁠Operational focus

Striptrack is intentionally narrow in scope.

It is a good fit when you need:

• a simple inbound HTML tracking cleanup layer
• a small self-hosted service with no heavy external dependencies
• auditable behavior and local persistence
• an easy-to-integrate component for Postfix-based mail infrastructures

⁠Limitations

• detection is heuristic-based, not exhaustive
• the main focus is HTML content sanitization
• some complex MIME structures may require future improvements
• this is not a full anti-spam, anti-phishing, or malware analysis engine

⁠Postfix

modify /etc/postfix/main.cf :

milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:12366
non_smtpd_milters = inet:localhost:12366