GitHub RadarBlue team tool

deeztek/Hermes-Secure-Email-Gateway

Hermes Secure Email Gateway is a Free Open Source Secure Email Gateway and Email Server Primary language: JavaScript. 141 stars.

Classification confidence: medium

Inferred from repository metadata; not a reviewed classification.

JavaScript141 stars26 forkspushed Oct 24, 2026AGPL-3.0

Project links:Open GitHub project Back to radar

README Preview

Fetched from GitHub

<h1 align="center">Hermes Secure Email Gateway and Email Server</h1>

Self-hosted email security, mail server, and Nextcloud: one stack, one Docker Compose file. Open-source spam & malware filtering, S/MIME & PGP encryption, DKIM/DMARC/ARC, mailboxes, webmail, and SSO. Pro adds time-of-click link protection, the inbound-link defense you'd otherwise pay Proofpoint or Mimecast for.

On GitHub since <a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/commit/3418b01a">December 2017</a> · <a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/commits/legacy">pre-Docker history: 186 commits, 2017-2025</a> · <a href="#project-history">Project history</a>

<a href="https://www.hermesseg.io/features/">Features</a> · <a href="https://docs.deeztek.com/shelves/hermes-seg-docker">Docs</a> · <a href="https://www.hermesseg.io/support/">Support</a>

Deployable as a gateway in front of Microsoft 365 / Google Workspace / Exchange, as a full mail server with built-in mailboxes, or in hybrid mode.

<img alt="Admin Dashboard" src="docs/images/screenshots/dashboard.png" width="32%">   <img alt="Message History" src="docs/images/screenshots/message-history.png" width="32%">   <img alt="Organizational Signatures" src="docs/images/screenshots/organizational-signatures.png" width="32%">

---

About

Hermes Secure Email Gateway is a Free Open Source Secure Email Gateway and Email Server.

It provides spam, virus, and malware protection through Apache SpamAssassin, ClamAV, and Amavisd-new; full in-transit and at-rest email encryption via SMTP TLS, S/MIME, PGP, encrypted PDF (powered by CipherMail), and Dovecot mail-crypt; full email archiving of every processed message, with self-service recovery for users and administrators; integrated mailbox hosting on Dovecot with per-user quotas, aliases, shared folders, Sieve rules, vacation auto-reply, and mobile-device autoconfiguration; file sync, webmail, calendars (CalDAV), and contacts (CardDAV) through Nextcloud; a local user directory and single sign-on via OpenLDAP and Authelia, with multi-factor authentication via TOTP, WebAuthn, and Duo Push; and modern email authentication standards including SPF, DKIM signing and verification, DMARC, and ARC through OpenDKIM, OpenDMARC, and OpenARC.

Hermes combines these Open Source technologies under one unified web-based administration console for easy management of your organization's inbound and outbound email, mailbox users, encryption keys, and authentication policies. End users get a self-service portal for managing their own signatures, sieve rules, vacation messages, app passwords, and mobile-device profiles.

Hermes can be deployed three ways:

As a gateway in front of an existing mail solution (in-house Exchange / Postfix, Google Workspace, Microsoft 365). Hermes scans, filters, encrypts, and relays mail to your backend.
As a full mail server with built-in mailbox hosting, webmail, file sync, calendars, and contacts. No external mail backend required.
As a hybrid, at either of two granularities:
Per domain: gateway for some domains AND mail server for others on the same install. Relay (gateway) domains and mailbox (mail server) domains coexist in a single deployment.
Per recipient, within one domain: keep some recipients on an external provider and host the rest on Hermes, on the same domain. Mail for each address is routed independently, so an organization paying per mailbox can keep the few people who genuinely need that provider and host everyone else locally. Fifty paid seats become ten, with no change to the domain's MX, its DNS, or anything a sender sees.

This Docker Edition packages the entire stack as a set of containers managed by Docker Compose, replacing the legacy bare-metal Ubuntu installer with a portable, reproducible deployment.

Editions

Hermes ships in two editions:

| Edition | License | What you get | |---|---|---| | Community | AGPL v3, free and open source | The entire mail gateway and email server stack. All core security, encryption, mailbox hosting, and administration features. | | Pro | Commercial, see EULA | Everything in Community plus 6 advanced features (see Pro Features below). |

A Pro license is purchased separately. Community Edition needs no license file and works fully without one.

The project is licensed under AGPLv3 (`LICENSE`); a small set of proprietary Pro Edition files are excluded from the AGPL grant and governed by the Pro EULA. See `LICENSING.md` for the authoritative breakdown; the per-file header controls which license applies.

Features

A condensed list. See hermesseg.io/features for the full feature page with screenshots.

Mail security (Community)

Spam protection (Apache SpamAssassin, postscreen, RBL configuration, sender/recipient/network block-allow lists, global sender filters)
Anti-virus protection (ClamAV via Amavisd-new, with built-in feeds: ClamAV official + URLhaus)
Malware feeds management (managed via Fangfrisch): configure additional 3rd-party signature feeds including SaneSecurity, MalwarePatrol, SecuriteInfo, TwinWave, ClamPunch, RFXN, InterServer, Ditekshen, and more
Per-recipient spam/virus/file policies
Custom message rules, score overrides, custom file expressions/extensions/rules
Quarantine, queue management, train as spam/ham, download messages
Recipient auto-provisioning: read the relay recipient roster from a directory on a schedule instead of typing or pasting it. Reads from LDAP/Active Directory, Google Workspace (Admin SDK, works on every Workspace edition) or Microsoft 365 (Microsoft Graph). Stages results for review, or provisions unattended. Additive only: it never deletes a recipient, and an empty or failed read changes nothing
Full email archiving: every processed message is archived, not only blocked mail. Clean deliveries, spam, banned attachments, and infected mail are each written to their own store. Searchable by date range, sender, recipient, subject, score, and verdict
Self-service recovery: recipients search Message History and release messages back to their own mailbox from the per-mailbox portal, without administrator involvement. Administrators see the whole system record and can release on any user's behalf; release always delivers to the original recipient, so it cannot be used to redirect another user's mail. History depth is a function of allocated archive storage: there is no retention setting to configure, and the oldest messages are pruned automatically once the archive disk crosses its capacity threshold

Encryption and authentication (Community)

In-transit email encryption: SMTP TLS, S/MIME, PGP (via CipherMail)
At-rest encryption: Dovecot mail crypt
Encrypted PDF email for recipients without S/MIME or PGP
Multi-factor authentication (Authelia): TOTP, WebAuthn, Duo Push
Local LDAP user store (built-in OpenLDAP) for admins, mailbox users, and relay users
App passwords for SMTP / IMAP / DAV clients (separate from main account password)
Free Let's Encrypt (ACME) TLS certificates: automated issuance and auto-renewal for the admin console and per mailbox domain (SAN), plus import/CSR support for 3rd-party certificates
haveibeenpwned password check integration

Email standards (Community)

SPF check, DKIM check + sign, DMARC verification (OpenDMARC)
ARC (Authenticated Received Chain) signing and verification (OpenARC): preserves authentication results across trusted forwarders
DKIM key generation and management (UI)
Multi-instance OpenDKIM for differential outbound-sign vs inbound-verify behavior
DMARC report aggregation and reporting

Email server / mailbox hosting (Community)

Local mailbox hosting (Dovecot 2.4) with IMAPS / POP3S / Submission (587/465) / LMTP
Per-domain and per-mailbox quotas
Mailbox aliases and forwarders
Shared mailboxes and shared folders, with subfolders shared and subscribed automatically
Per-recipient delivery on a single domain: relay some recipients to an external provider and deliver others to a local mailbox, chosen per address. Convert a relay recipient to a hosted mailbox in place, individually or in bulk, and convert back again
Convert a departing user's mailbox into a shared mailbox, keeping their mail reachable instead of orphaned
User-defined Sieve rules
Vacation auto-reply with date scoping and per-address filtering
Mobile device autoconfiguration via signed .mobileconfig profiles (iOS) and CalDAV/CardDAV autodiscovery
Personal email signatures (rich HTML, with template gallery)
External Sender Banner (inbound mail from outside the org gets a visual banner)

Nextcloud integration (Community)

File sync (Nextcloud Files)
Webmail (Nextcloud Mail)
Calendars (CalDAV) and contacts (CardDAV)
Single sign-on via Authelia OIDC
Pre-provisioning of Nextcloud user accounts on first login
Team chat, voice/video calls, and meetings via Nextcloud Talk (optional: the app is not enabled by default, and dependable calls need the high-performance backend, deployed separately. See Nextcloud Talk and the High-Performance Backend)

Admin and user experience (Community)

Modern AdminLTE 4 / Bootstrap 5 administrator console
User self-service portal (per-mailbox)
Real-time dashboard with system-resource monitoring
Message statistics with visual charts