0009. Mail runs on its own IP, written in Go

Status: accepted, 2026-10-09

Context

The author wants a full mail server and webmail (like Stalwart and Bulwark). Stalwart is Rust, Bulwark is TypeScript; both break the one-stack rule. A control-plane server often runs other things (a VPN exit, a proxy) whose traffic puts its IP on block lists, which kills deliverability.

Decision

mail is our own Go server built on proven libraries (emersion's go-smtp, go-imap v2, go-msgauth, go-message), with JMAP for the webmail, and a webmail panel on our stack.
Mail is deployed on a node whose IP is used for nothing else, with outbound port 25 open and reverse DNS set. A smarthost relay is supported for networks where that is impossible.
It is the last service on the roadmap.

Consequences

Deliverability work (DKIM, SPF, DMARC, ARC, TLS-RPT, MTA-STS, rDNS checks) is part of the service, with a DNS checklist in the panel.