TMail

English · Русский

A complete, self-hosted mail server with a modern webmail and an AI assistant — installed on one Linux server with one command.

• Mail server: Postfix (SMTP), Dovecot (IMAP/POP3, quotas, server-side filters), Rspamd (spam, DKIM signing, SPF/DKIM/DMARC checks), ClamAV (antivirus: attachments cannot be downloaded until they are checked), Let's Encrypt certificates, PostgreSQL as the single source of truth.
• Webmail: Gmail-like interface in 100 languages, conversations, fast full-text search (also inside attachments), previews of PDF/Office/images, large files as links (Garage S3), labels, folders with auto-sorting, calendar with reminders, templates, signatures with images, delayed send with undo, spell checking, browser notifications, dark mode, phone layout.
• Several mailboxes per user: one login works with many mailboxes; replies go from the address the letter came to. Collector for external mailboxes (Gmail, any IMAP/POP3) with sending through their own SMTP.
• AI assistant (optional, any OpenAI-compatible API — OpenAI, OpenRouter, or your own model on vLLM/Ollama): replies, summaries, rewriting, dictation, auto-replies, sorting, and contact cards of companies and people extracted from letters and their attachments. Prompts are editable in the admin panel. MCP access for external AI agents.
• Administration: users and roles, mailboxes, aliases, domains with live DNS checks, collector, antivirus, server health, audit log. Watchdog, fail2ban, firewall and encrypted incremental backups are set up by the installer.

See it

▶️ Watch the 2-minute tour (MP4) · all screenshots, in English and Russian: docs/screenshots

New mail arrives live	Reply with AI
Send with Undo	Spell check that fixes misplaced spaces

Who wrote and who answered: company, tax ID and phones of the sender	The reply goes from the mailbox the letter came to
PDF, Office and image previews built in	Scanned documents: select and copy the recognised text
Every attachment checked by the antivirus; download all as zip	Phishing warning: failed SPF/DKIM/DMARC, risky links marked
Right-click: formatting, dictation, AI rephrase and fix	Reply templates, with AI picking the right one
AI finds the questions of a letter and offers answers	AI summary of a long letter
Calendar, reminders, goals, tasks and notes next to the mail	Contact cards built from the correspondence, for any country
Fast search across all mailboxes, with filters	Colour schemes, backgrounds, dark mode
100 interface languages, per user, with time zone	Ready settings for phones and desktop mail apps
Admin overview: what needs attention, service health	Users, roles and access to shared mailboxes
Domains with live DNS checks (MX, SPF, DKIM, DMARC, PTR)	Any AI: OpenAI, OpenRouter or your own model
Antivirus with quarantine	Server health: CPU, memory, disk, queue, certificates
Dark theme	Works on phones

Try the interface on your computer with invented data (no mail server needed): cd web && npm ci && npx nuxt generate && node demo/server.mjs --lang en → http://127.0.0.1:8790

Built for teams that share mailboxes

Most companies have mailboxes that several people answer: sales@, support@, info@, orders@. TMail is designed around that:

• One login, many mailboxes. Each employee signs in once and sees every mailbox they were given access to — together in one list or one by one. Access is granted per mailbox, read-only or with sending, and taken away in one click; nobody shares a mailbox password.
• Replies go from the right address. A reply is sent from the mailbox the letter came to, with that mailbox's signature.
• Everyone sees who answered. Sent letters show which employee sent them; the conversation, read state, labels and folders are shared by the team in real time.
• External mailboxes too. Gmail or any IMAP/POP3 mailbox can be connected and used by the team the same way, sending through its own SMTP.
• Plus contact cards of companies and people built from the correspondence, so the whole team knows who a sender is, their company, tax ID and phones.

Phones, calendars, security

• Calendars and contacts on the phone. CalDAV and CardDAV: calendars (your own and those shared by colleagues) and contacts sync with iPhone, Android (DAVx⁵), macOS and Thunderbird. A calendar can also be shared as a read-only ICS link for Google, Apple or Outlook Calendar. Events repeat.
• Mail programs set themselves up. Thunderbird and Outlook find the server from the address (autoconfig/autodiscover); each phone or program gets its own app password that can be revoked.
• Send later and snooze. A letter can be sent at a chosen time by the server, even with the browser closed; an incoming letter can be hidden until a time and come back to the top of the Inbox.
• Search across all folders: Inbox, Sent, Drafts, Archive and your own folders at once.
• OpenPGP: sign and encrypt letters, verify and decrypt incoming ones, correspondents' keys from their letters (Autocrypt) or added by hand.
• Installable app (PWA) that opens without a network; three list densities; a home page with unread mail, the week's events and the latest files.
• Delivery security: outgoing TLS checked by DANE and MTA-STS, an MTA-STS policy for incoming mail, checks of the DKIM key, blocklists (Spamhaus and others) and certificate expiry.
• Mail server settings for the admin: sending through an external SMTP relay, per-mailbox sending limits against spam from a hijacked mailbox, and an encrypted export of the whole configuration to move to another server.

Requirements — light by design

TMail is written to run on small servers. Every part is chosen and tuned for memory: the webmail backend is a single Go binary (~40 MB of RAM), search uses a PostgreSQL index instead of a separate search server, and the antivirus is configured not to double its memory while updating.

	Minimum	Recommended
Memory	2 GB (+ swap, created by the installer)	4 GB
CPU	1 core	2+ cores
Disk	20 GB + mail	SSD

Measured on a production server (4 vCPU, 6 GB RAM) holding 66 GB of mail, 146,000 indexed letters, with the antivirus, spam filter, document previews and AI features on: all services together keep about 1.2 GB in memory (plus about 1.4 GB of rarely used data — mostly the antivirus signatures — in swap).

How that compares with the minimums the other self-hosted mail servers publish (with antivirus):

	Minimum memory
TMail	2 GB
Mailu	3 GB + 1 GB swap (docs)
iRedMail	4 GB recommended (forum)
mailcow	6 GB + 1 GB swap (docs)

Other requirements:

• A public IPv4 address; Ubuntu 22.04+ or Debian 12+ (other Linux distributions with Docker work too).
• Outgoing port 25 must be open (some hosting providers block it until asked).
• A domain whose DNS records you can edit, and reverse DNS (PTR) for the server's IP address (set at the hosting provider).

Installation

git clone https://github.com/cernos2/TMail.git /opt/tmail
cd /opt/tmail
sudo ./install.sh

The installer checks the server, installs Docker, asks for the domain, the administrator, the interface language, the country (company details and phone numbers are recognised for it), the time zone, the AI service and where to keep backups; then it builds and starts everything, creates the domain with its DKIM key, the first mailbox and the administrator, and prints the DNS records to add. Everything can be passed as options for an unattended installation — see ./install.sh --help.

The credentials are saved to /root/tmail-credentials.txt. Keep the backup password somewhere outside the server: backups cannot be read without it.

DNS records

Name	Type	Value
mail.example.com	A	server IP
files.example.com	A	server IP
example.com	MX	10 mail.example.com
example.com	TXT	v=spf1 mx -all
<selector>._domainkey.example.com	TXT	printed by the installer (docker compose run --rm ctl dns example.com)
_dmarc.example.com	TXT	v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com
PTR of the server IP		mail.example.com (at the hosting provider)

Recommended, not required: autoconfig and autodiscover CNAME → mail.example.com (mail programs set themselves up); mta-sts CNAME → mail.example.com and _mta-sts TXT v=STSv1; id=…; _smtp._tls TXT v=TLSRPTv1; rua=mailto:postmaster@example.com; a TLSA record for DANE only if the zone is signed with DNSSEC. Domains shows the exact values with copy buttons.

The admin panel (Domains) checks every record live. The HTTPS certificate is issued automatically as soon as mail.example.com points to the server.

AI assistant

Choose the service in Admin → AI assistant: OpenAI, OpenRouter (hundreds of models with one key), or your own model behind any OpenAI-compatible API. The assistant's name, the default model, a separate speech-recognition API (OpenRouter has none) and every prompt are configurable there. To read scanned documents and PDF pages the model must accept images.

Everyday operation

cd /opt/tmail
docker compose ps                          # state of every service
docker compose logs -f postfix dovecot     # logs
alias tmail='docker compose run --rm ctl'
tmail mailbox add anna@example.com --name "Anna Smith"
tmail user add anna --name "Anna Smith" --mailboxes anna@example.com,info@example.com
tmail domain add example.org && tmail dkim gen example.org && tmail dns example.org

Mail programs: IMAP mail.example.com:993 (SSL/TLS) or POP3 :995; SMTP :465 (SSL/TLS) or :587 (STARTTLS); the login is the full address or an app password. Calendars and contacts: CalDAV/CardDAV at https://mail.example.com/dav/. Each user finds ready settings (and an iPhone/Mac profile with mail, calendars and contacts) in the webmail settings.

Update

cd /opt/tmail && git pull && sudo ./install.sh --yes

The installer keeps the settings and the data; it rebuilds the services, applies database changes and rebuilds the web interface.

Backups

deploy/backup.sh runs every night (restic: incremental, deduplicated, encrypted; 7 daily, 4 weekly, 3 monthly snapshots). Set BACKUP_REPOSITORY in .env to S3 (s3:https://host/bucket with AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) or SFTP (sftp:user@host:/path) to keep them off the server. Restore — on the same or a new server:

BACKUP_REPOSITORY=… BACKUP_PASSWORD=… deploy/restore.sh --list
BACKUP_REPOSITORY=… BACKUP_PASSWORD=… deploy/restore.sh latest /opt/tmail

License

TMail is free software under the GNU Affero General Public License v3.0 with an additional attribution term (see NOTICE): if you run TMail — changed or not — for other people, keep the "TMail" link to this repository visible in the interface, and publish your changes under the same license.

Translations

The interface texts are in web/app/locales/<language>.json; see web/I18N.md. Corrections by native speakers are very welcome.

Layout

Path	What
install.sh	installer and updater
compose.yml	every service (host network; internal ports only on 127.0.0.1)
services/	Postfix, Dovecot, Rspamd, Unbound, ClamAV, certificates, Garage, document previews
backend/	zmaild (Go): webmail API, IMAP/SMTP on behalf of mailboxes, live updates, admin, AI
ctl/	zmail command-line tool and the database schema (ctl/migrations)
web/	the web interface (Nuxt 4)
deploy/	backups, restore, firewall, fail2ban, watchdog, web build