Enterprise Mail
Self-Hosted Infrastructure at Arivu
Arivu Technologies runs its own enterprise-grade, self-hosted mail and groupware infrastructure on mail.arivu.tech - 10+ microservices including Postfix MTA, Dovecot IMAP, SOGo groupware, Rspamd ML anti-spam, DNSSEC resolver, and a self-healing Watchdog. Zero SaaS dependency. Complete data sovereignty.
Data sovereignty, zero vendor lock-in.
Google Workspace and Microsoft 365 are convenient - but they mean an external company holds every email archive, communication metadata, and security key for your organization. As Arivu Technologies scaled its engineering team, the recurring per-mailbox SaaS cost and data residency concerns made the case for a self-hosted solution compelling.
Data Sovereignty
100% control over email archives, metadata, and encryption keys - on-premises, no third-party access.
Cost Elimination
No per-user recurring SaaS licensing fees. Fixed infrastructure cost as Arivu's team grows.
Deliverability Control
Custom DKIM, SPF, DMARC, and PTR records give full control over sender reputation scoring.
Isolated container topology.
Every service, documented.
Handles SMTP on ports 25/465/587. Postscreen blocks abusive IPs at TCP handshake via multi-provider DNSBL before any SMTP conversation starts.
Encrypted IMAP/POP3 via ports 143/993 and 110/995. Maildir storage format. Optimized: FTS and ClamAV disabled for lean memory footprint.
Full groupware suite with shared calendars, address books, and task lists. Native ActiveSync/CalDAV/CardDAV sync for iOS, Android, macOS, and Outlook.
Neural Bayesian spam engine with SPF/DKIM verification, DMARC policies, fuzzy hashes. Olefy scans Office attachments for VBA macros. Auto-signs outgoing mail with 2048-bit RSA/Ed25519 keys.
Stores domains, mailboxes, aliases, DKIM keys, and quota data. Isolated container on 172.22.1.0/24 network bound to 127.0.0.1:13306.
Sub-millisecond rate limiting counters, session data, Rspamd fuzzy hash cache, and Netfilter ban list coordination. Bound to 127.0.0.1:7654.
FastCGI proxy to PHP-FPM Admin UI and SOGo Webmail. Handles HTTPS 443 with Let's Encrypt TLS certificates. Automated renewal via acme.sh.
Containerized recursive DNS resolver with DNSSEC validation. Bypasses public resolvers (8.8.8.8) to avoid DNSBL query rate limits and prevent DNS cache poisoning.
Parses authentication failure logs from Postfix, Dovecot, SOGo, and Web UI. Auto-injects iptables/nftables DROP rules for brute-force attackers.
Active health checks on every container. Unhealthy containers auto-restart. Discord/Slack webhook + admin email alerts on service restarts and IP ban events.
Real production config from mail.arivu.tech.
Multi-provider IP reputation scoring on TCP handshake - before any SMTP conversation. Weighted scoring: Spamhaus (weight 8), Barracuda (7), with DNSWL whitelisting (negative score to -8) to prevent false positives.
1# Multi-tiered DNSBL IP reputation engine2postscreen_dnsbl_sites =3 wl.mailspike.net=127.0.0.[18;19;20]*-24 hostkarma.junkemailfilter.com=127.0.0.1*-25 list.dnswl.org=127.0.[0..255].0*-26 list.dnswl.org=127.0.[0..255].1*-47 list.dnswl.org=127.0.[0..255].2*-68 list.dnswl.org=127.0.[0..255].3*-89 bl.spamcop.net*210 b.barracudacentral.org=127.0.0.2*711 zen.spamhaus.org=127.0.0.[10;11]*81213# Primary MTA identity14myhostname = mail.arivu.tech15mynetworks_style = host1617# SMTP security enforcement18smtpd_tls_security_level = may19smtp_tls_security_level = may20smtpd_sasl_auth_enable = yesMulti-layer defense. High deliverability.
Inbound protection (multi-DNSBL Postscreen + Rspamd ML) and outbound reputation (DKIM/SPF/DMARC signing) are configured to achieve high inbox placement in Gmail, Outlook, and Yahoo.
Postscreen Multi-DNSBL (Inbound)
- Spamhaus Zen (weight 8) - known spammers, open relays
- Barracuda Central (weight 7) - aggressive spam domain/IP filtering
- DNSWL whitelisting (negative score to -8) - prevents false positives on clean senders
- SpamCop + SuomiSpam - real-time spam trap enforcement
Rspamd Neural Engine (Inbound)
- Bayesian statistical learning from spam/ham corpus
- Fuzzy hash matching for known spam payloads
- SPF, DKIM, DMARC policy enforcement
- ARC (Authenticated Received Chain) verification for forwarded mail
Olefy Office Attachment Defense (Inbound)
- Scans .doc, .xls, .xlsm for malicious VBA macros
- Detects embedded scripts before delivery to mailbox
- Plugs directly into Rspamd milter chain
Full webmail + calendar + contacts + tasks.
Webmail Interface
Full-featured browser-based email client. Shared folders, message threading, HTML composition with attachment support.
Shared Calendar (CalDAV)
Team calendars with meeting invites, resource booking, and free/busy visibility. Native iOS, Android, macOS, and Outlook sync via CalDAV.
Address Book (CardDAV)
Shared team contacts synchronized across all devices. Contact groups, vCard import/export, and fine-grained sharing permissions.
Microsoft ActiveSync (EAS)
Push email and calendar sync to mobile devices using ActiveSync protocol - same protocol used by Microsoft 365.
Session Security
8-hour session timeout (SOGO_EXPIRE_SESSION=480). Custom 16-character URL encryption key encrypts embedded mail tokens in links.
Autodiscovery
Zero-touch client setup: Outlook Autodiscover XML/JSON, Mozilla Thunderbird Autoconfig, and Apple .mobileconfig profile generation.
Every critical parameter, documented.
Defense in depth, containerized.
Private Network Isolation
All inter-service communication bound to the 172.22.1.0/24 bridge network. Administrative ports (MySQL :13306, Redis :7654, Doveadm :19991) bound to 127.0.0.1 loopback only - inaccessible from the public internet.
Netfilter Dynamic Firewall
Fail2ban continuously parses authentication failure logs across Postfix, Dovecot, SOGo, and the Web UI admin panel. Brute-force IPs receive automatic iptables/nftables DROP rules - no human action required.
Unbound DNSSEC Resolver
Containerized recursive DNS resolver with DNSSEC validation bypasses public resolvers (Google 8.8.8.8) to avoid DNSBL query rate limits and protect against DNS cache poisoning attacks.
WebAuthn / FIDO2 MFA
Hardware security key (YubiKey, etc.) support enabled for the Mailcow Admin UI. Eliminates password-only authentication risk for the administrative control plane.
Self-healing. Point-in-time recovery.
Automated Watchdog self-heals container failures. Cold standby sync enables rapid server failover. Backup suite captures all state for point-in-time restore.
Watchdog Auto-Heal
Active health checks every 60 seconds across all containers. Unhealthy containers automatically restart. Discord/Slack webhook + admin email alerts on restarts and IP ban events.
Cold Standby Sync
create_cold_standby.sh keeps a secondary server synchronized with current production state. In a hardware failure, failover to standby with minimal downtime.
Full Backup Suite
backup_and_restore.sh captures MariaDB relational data, Redis cache, Rspamd ML state, vmail Maildir storage (all mailboxes), and SSL/TLS certificates in a single compressed archive.
Automated Updates
Mailcow updates managed via update.sh with automatic pre-update backup and rollback capability. No manual Docker image management required.
REST API Automation
Full JSON REST API allows Arivu to automate mailbox creation, alias mapping, quota updates, DKIM key generation, and domain routing from internal HR/IT dashboards.
What this says about how Arivu engineers.
Running a production Mailcow stack isn't just a cost-saving measure - it demonstrates Arivu's engineering culture: full-stack, infrastructure-literate engineers who own what they build from application layer to DNS record.
Production Infrastructure Ownership
Arivu's engineers configure, operate, and maintain production containerized infrastructure - not just SaaS-configured apps.
DNS, SPF, DKIM, DMARC Expertise
End-to-end email authentication configuration - from PTR records to DMARC rua reporting - reflects deep networking and deliverability knowledge.
Security-First Mindset
Multi-DNSBL reputation scoring, Fail2ban dynamic firewall, WebAuthn MFA, and private network isolation reflect the same security posture applied to client production systems.
How an email travels through the stack.
TCP Connection
Inbound SMTP connection on port 25. Postscreen immediately checks sender IP against multi-provider DNSBL scoring - before any SMTP conversation.
DNSBL Scoring
Spamhaus (8), Barracuda (7), DNSWL negative scores (-8). Threshold exceeded = connection rejected at TCP level.
SMTP Authentication
EHLO, STARTTLS, AUTH PLAIN/LOGIN. Postfix validates sender authentication credentials via Dovecot SASL.
Rspamd Milter
Every message body, headers, and attachments pass through Rspamd for Bayesian scoring, SPF/DKIM/DMARC check, and Olefy Office macro scan.
LMTP Delivery
Postfix delivers via LMTP to Dovecot for Maildir storage. Dovecot sessions with Redis for rate limiting and session cache.
DKIM Auto-Sign
Outgoing mail from arivu.tech is automatically signed with 2048-bit RSA or Ed25519 DKIM key via Rspamd before transmission.