Hi everyone!
I’d like to share with the community an open-source project we recently released under the AGPL-3.0 license: webmailMaquita.
It is a webmail and collaboration suite designed to address a very specific need: providing advanced compliance capabilities such as eDiscovery, legal hold, and DLP on self-hosted mail servers based on Postfix + Dovecot, without relying on per-user commercial licenses or cloud suites.
💡 Why did we build it?
In production environments running on Postfix + Dovecot, Roundcube was too limited for our auditing and interface needs, while advanced DLP and compliance features are usually reserved for expensive enterprise licenses.
We decided to build an open-source layer that provides these capabilities while keeping the infrastructure under our own control.
🚀 Main features
✉️ Webmail and Interface
Stack: Built with React + FastAPI, with support for conversation threads, labels, Sieve rules, and full-text search.
Productivity: Calendar and contacts via CalDAV/CardDAV, Kanban tasks, and chat.
Security: Two-factor authentication (2FA TOTP) and email encryption at rest using Dovecot mail_crypt.
🛡️ Email Security
Authentication: SPF, DKIM, DMARC, and Rspamd.
Anti-spoofing: Detection of lookalike domains, homoglyphs, and impersonation of internal roles.
Outbound DLP: Detection of sensitive data such as national ID numbers, tax IDs, IBANs, and payment card information. It also works with Outlook and mobile clients through a milter.
Active defense: Automatic detection and containment of compromised accounts generating high-volume outbound email.
📊 Compliance and eDiscovery
Forensic search: Search across all mailboxes, legal holds, and custodian management.
Digital signatures: Email exports signed with GPG and timestamped using RFC 3161.
Traceability: Logging of 39 event types with end-to-end correlation:
Postfix → Rspamd → Dovecot → user action
🧰 Additional tools included in the repository
Drive and local AI: Shared drives, OnlyOffice integration, and an optional 100% local AI module using Ollama/Whisper for dictation and suggestions without sending data to external APIs.
⚙️ Deployment
It runs natively on Debian using a reproducible installation script.
🔍 Current status and limitations
We want to be transparent about what is still in progress:
Automatic retention: Policies can already be defined through the interface, but the automated purge/archive process is still under development.
Quarantine: Currently managed by administrators.
Scale: Tested with approximately 300 mailboxes and more than 100,000 emails in a real production environment, but not yet validated in deployments with thousands of concurrent users.
🤝 Source code and repository
🔗 https://github.com/wilsongabriel30/webmailMaquita
The project is fully open source.
We would especially appreciate:
testing on clean Debian installations;
security reviews;
bug reports;
feedback on the architecture;
feedback on the roadmap;
contributions from developers and sysadmins.
We hope it can be useful to others looking for a self-hosted, privacy-focused alternative for email infrastructure and compliance.