This is the mail server behind lockflare.com. We run it from Vigia.

The server on this page is our own box: mail.lockflare.com, the server that sends and receives our mail. Nothing here is a demo. Mail is thirty percent software and seventy percent reputation, so Vigia does not stop at installing Postfix — it reads the box the way a receiving server does, says each fact in words, and hands over the exact DNS records to copy until every one of them is green.

The box, as receivers see it

Whether your mail arrives is decided by strangers' servers, and they judge the machine before they read the message. Can it reach other mail servers on port 25 at all. Does its address reverse to the name it introduces itself with, and does that name resolve back to it. Is the certificate on its doors good. Is the address on a blacklist. Vigia asks all of it from the box itself, each time you look, and says the answer in a sentence — with the three lists it checked named, so "not listed" means something.

Everything it sets is Postfix's own configuration through postconf, and OpenDKIM's own files. Nothing is hidden in a layer of ours: postconf in a terminal still tells the truth. And nothing on the internet reaches Postfix until a section opens it — sending needs only the records.

6facts a receiver judges a box by, each read and said in words

3blacklists checked by name: Spamhaus, SpamCop, Barracuda

87 daysleft on our certificate the day the picture at the top was taken — it renews itself

A domain is a card, and its records are there to copy

Every domain the box sends for has a DKIM key of its own and says whether its mailboxes live here or somewhere else. Open one and Vigia reads what receivers check before they trust mail from it — SPF, DKIM, DMARC, MX — straight from DNS.

What is missing is said as a consequence, not a code: "no SPF record — receivers cannot tell this box is allowed to send for it".
Under it, the exact records to publish, as a table, with a copy button on the name and another on the content. Paste them at your DNS host and the dots turn green on the next look.
A domain can send only — for an app, a WordPress, an n8n — or have its mailboxes here, with Dovecot on 993.

Our own domain, fully set up

lockflare.com as it stands today: SPF ends in -all, and DMARC is at quarantine with strict alignment. Vigia can read the reports it asks for, too: a collector mailbox per domain, the daily XML from Google, Microsoft, Yahoo and Apple folded by sending address, each named in words — the only place a domain owner sees who else is sending as them.

The DKIM key is rotated the way it should be and almost never is: the next key is made and its record published while the current one goes on signing; when DNS has it, one button switches, and mail is signed with the new key from the next message while the old one stays for mail already in transit. And mail programs set themselves up: the autoconfig and autodiscover names, the SRV records for IMAP and submission, MTA-STS and TLS reporting are all read and shown green — Thunderbird, Outlook and Apple Mail find the server from the address alone.

/ THE WAY IN, THE WAY OUT

A spam filter that learns from your Junk folder.

rspamd scores everything on the way in and signs everything on the way out. Spam lands in Junk, and moving a message into Junk or out of it teaches the filter — no separate training step, no console. Three numbers decide what happens to a message: the score at which a first-time sender is told to try again (real servers do; spam cannons do not), the score at which it is marked and filed to Junk, and the score at which it is refused during delivery so the sender gets a bounce. Each is a field with what it costs to move it said beside it.

rspamd's own panel stays on the box's loopback. Vigia reaches it through a tunnel over your login, saved for that server and opened on connect — nothing is opened to the world to look at a spam filter.

Who may log in, and what happens to whoever guesses

Two doors on a mail server take a password — IMAP on 993 to read, submission on 587 to send — and two kinds of login open them.

Mailboxes: a person's address on a domain that lives here, from a phone or a mail program.
App logins, for software that only sends through this box — a WordPress or an n8n on another server, a script. They open 587 only: no mailbox, nothing ever delivered to them, and they cannot read mail. The password is shown once, when it is made; Vigia keeps only its hash, so a lost one is replaced, not recovered.
The sender's own address, hidden. Every message sent through a login carries a header saying where it was written from — at home, in a café, in a hotel — and every recipient can read it. Gmail and Outlook strip that line for their users; this box strips it too.
fail2ban watches both doors: five wrong passwords in ten minutes and the address is banned for an hour, doubling each time it comes back.

What happened to a message, in words

The day, counted from the mail log: sent, waiting, bounced; delivered to mailboxes, refused at the door; and how much each login has sent. A limit per login, enforced by the spam filter — Vigia offers two hundred an hour — is the difference between a stolen password and a blacklisted server: a stolen password sends two hundred an hour, then stops.

And the question every mail admin is asked: "did my message arrive?" Type an address, a queue id or a word, pick how many days back, and Vigia finds every message it touched and what the other side said about it — in words, not in log lines. The queue and the raw log are a tab away when you want them.

/ THE REST OF ITS LIFE

The rest of a mail server's life.

Send only, mailboxes, the certificate on every door — and nothing of ours on the box.

Send onlyPostfix on loopback, DKIM signing, direct delivery or a relay — SES, Mailgun, Postmark, your own server. What a box that only needs to send should be, with nothing on the internet able to reach it. Who may send: its containers, other servers by address, logins on 465 or 587 behind TLS.

MailboxesThe Mail tool in the rail, apart from the setup: people and their mailboxes, each with its own forwarding and out-of-office reply, aliases, a catch-all. Mailboxes backed up, moved to another server, migrated in from wherever they were.

The certificateOne Let's Encrypt certificate for 465, 587 and 993, renewed by certbot, with Postfix and Dovecot reloaded after. Vigia says how many days it has left, and which file it is reading that from.

Nothing of oursPostfix, Dovecot, OpenDKIM, rspamd and fail2ban, installed as the ordinary packages they are and each configured through its own files. Vigia is not in the path of a single message, and the server goes on working with Vigia closed.

Certificates and the vault The other packages

/ QUESTIONS

Questions people ask.

The six we hear most about running mail from Vigia.

Is this really your own mail server?

Yes. The server on this page is mail.lockflare.com, the box that sends and receives LockFlare's mail, set up and run from Vigia.

Will my mail land in the inbox?

Vigia cannot promise that, and nobody honestly can: receivers decide. What it does is read the facts they decide by — outbound port 25, reverse DNS, the host name, SPF, DKIM and DMARC, the certificate, the blacklists — say each in words, and give you the exact records to publish until they are all green.

Does Vigia sit in the path of my mail?

No. Postfix, Dovecot, OpenDKIM, rspamd and fail2ban are installed as ordinary packages and configured through their own files. Vigia reads and writes over your SSH login; no message passes through it, and the server runs the same with Vigia closed.

Can a server only send, without mailboxes?

Yes. Send only keeps Postfix on loopback, signs with DKIM and delivers direct or through a relay. A domain can also send from this box while its mailboxes live elsewhere, and software on other servers can send through it with an app login that opens port 587 only.

How are DKIM keys rotated?

In steps, without a gap: the next key is made and its DNS record published while the current key goes on signing; when the record is visible, one button switches and mail is signed with the new key from the next message, while the old one stays published for mail already in transit.

What stops a stolen password from getting the server blacklisted?

A sending limit per login, enforced by the spam filter — Vigia offers two hundred messages an hour — so a stolen password sends two hundred an hour and then stops, and fail2ban on both login doors, banning an address for an hour after five wrong passwords in ten minutes and doubling each time it returns.

Run your own mail, and see what receivers see

Vigia is free for 10 servers. Nothing is installed on them to try it.

Download Vigia