Mailer Services¶

The mailer layer is the beating heart of Mailyte. These are the services that actually move, store, filter, and protect email. They run as separate Docker containers and communicate over the internal Docker network.

Architecture at a Glance¶

flowchart TB
    Internet((Internet))

    subgraph Mailer["Mailer Services"]
        direction TB
        Postfix["Postfix\nSMTP MTA\n:25 / :587 / :465"]
        Dovecot["Dovecot\nIMAP/POP3\n:143 / :993 / :110 / :995"]
        Rspamd["Rspamd\nAnti-Spam\n:11332 / :11334"]
        CertMgr["Certificate Manager\nAuto SSL\n:80 (ACME)"]
        IDS["Intrusion Detection\nFail2ban"]
        LogAn["Log Analyzer\nPattern Detection"]
    end

    subgraph Storage["Shared Storage"]
        MailDir["/var/mail/vhosts"]
        SSLCerts["/etc/ssl"]
        Logs["/var/log"]
    end

    subgraph Backends["Backend Services"]
        MySQL[(MySQL)]
        Redis[(Redis)]
    end

    Internet -->|"SMTP :25"| Postfix
    Internet -->|"Submission :587/:465"| Postfix
    Internet -->|"IMAP :143/:993"| Dovecot
    Internet -->|"POP3 :110/:995"| Dovecot

    Postfix -->|"LMTP :24"| Dovecot
    Postfix -->|"Milter :11332"| Rspamd
    Postfix -->|"SASL :24100"| Dovecot

    Postfix --> MySQL
    Dovecot --> MySQL
    Rspamd --> Redis

    CertMgr -->|"SIGHUP reload"| Postfix
    CertMgr -->|"SIGHUP reload"| Dovecot

    IDS -->|"reads"| Logs
    LogAn -->|"reads"| Logs

    Postfix --> MailDir
    Dovecot --> MailDir
    CertMgr --> SSLCerts

Service Quick Reference¶

How Mail Flows Through the System¶

Understanding the mail flow helps you debug delivery issues and tune performance.

Outbound (your user sends an email)¶

sequenceDiagram
    participant User as Email Client
    participant PF as Postfix :587
    participant DV as Dovecot :24100
    participant RD as Redis
    participant RS as Rspamd
    participant Remote as Remote MTA

    User->>PF: Connect (STARTTLS/TLS)
    PF->>DV: SASL auth check
    DV-->>PF: Auth OK
    PF->>RD: Rate limit check
    RD-->>PF: Within limits
    PF->>RS: DKIM signing + headers
    RS-->>PF: Signed message
    PF->>Remote: Deliver via SMTP

1. User connects to Postfix on port 587 (STARTTLS) or 465 (implicit TLS).
2. SASL authentication — Postfix delegates to Dovecot on port 24100 to verify credentials against MySQL.
3. Rate limiting — the rate_limit_policy.py policy server checks per-mailbox, per-domain, and per-org hourly limits in Redis.
4. Content filtering — the email passes through the tracking injector, which adds open/click tracking pixels for HTML emails.
5. Rspamd milter — signs the email with DKIM, adds authentication headers.
6. Delivery — Postfix hands the email to the remote MTA over SMTP.
7. Webhook notification — the webhook sender fires an email.sent event.

Inbound (someone sends email to your user)¶

sequenceDiagram
    participant Remote as Remote MTA
    participant PF as Postfix :25
    participant RS as Rspamd
    participant DV as Dovecot :24
    participant Store as Maildir Storage

    Remote->>PF: Connect SMTP
    PF->>PF: Postscreen (DNSBL, pregreet)
    PF->>PF: SMTP restrictions (RBL, HELO, sender)
    PF->>RS: Content scan (spam, virus, DKIM)
    RS-->>PF: Score + headers
    PF->>DV: LMTP delivery
    DV->>DV: Sieve filters
    DV->>DV: Quota check
    DV->>Store: Write to Maildir

1. Postscreen filters out spam bots using DNSBL lookups, pregreet detection, and pipelining checks. This alone blocks about 80% of junk.
2. SMTP restrictions — Postfix applies RBL checks, HELO validation, sender/recipient validation.
3. Rspamd milter — full spam analysis: Bayesian filtering, SPF/DKIM/DMARC verification, ClamAV virus scan, phishing detection, neural network scoring.
4. LMTP delivery — Postfix hands the email to Dovecot via LMTP on port 24.
5. Sieve filtering — Dovecot runs per-user and global Sieve scripts (smart folders, vacation replies, etc.).
6. Quota check — Dovecot enforces the mailbox quota. If the user is over quota, the email bounces with a temporary failure.
7. Storage — the email lands in /var/mail/vhosts/{domain}/{user}/ as Maildir.

Shared Infrastructure¶

All mailer services share these backend resources:

Related Sections¶

• Worker Modules — The API, tracking, webhooks, and analytics layer that sits on top of the mailer
• Configuration — Detailed configuration for Postfix, Dovecot, and Rspamd
• Monitoring — Health checks and metrics for all mailer services
• Reference > CLI Commands — Docker exec commands for managing mailer services