OPENBSD FOUNDATION
PF, WireGuard, Unbound, TLS and a hardened host.
SECURE COMMUNICATIONS / OPENBSD
Secure email,
built to be owned.
OPENBSD SECURE MAIL PLATFORM
Email is the backbone of every organization. This platform combines a hardened OpenBSD mail stack with OSMAP, secure browser access, strong identity controls, filtering, monitoring, backup and recovery.
WHY THIS PLATFORM
A complete mail system, engineered as one security boundary.
LEAST-PRIVILEGE ACCESS
Rust webmail, server-rendered, no runtime JavaScript.
MAIL SECURITY PIPELINE
Postfix, Dovecot, Rspamd, ClamAV and standards-based mail.
OPERATIONS BUILT IN
Monitoring, staged updates, backup, recovery and verification.
THE USER EXPERIENCE
Security people can see. Mail people can use.
OSMAP turns hardening into an understandable product experience: mail, composition, search, documents, identity, privacy, security state, key management and account recovery.
MAILBOX & PRODUCTIVITY
Inbox, search, drafts, documents and clear operational state.
COMPOSE & DELIVERY
Identity-aware composition with policy-driven security preflight.
IDENTITY & KEY MANAGEMENT
Key status, trust readiness, fingerprints and governed account actions.
Approved UX direction; runtime OpenPGP operations are not yet implemented.
DEFENSE IN DEPTH
Security from the browser to the wire.
The web interface never becomes the mail authority. Public access terminates at nginx; mailbox authority, transport, filtering and operations remain separated behind explicit boundaries.
- Browser
- nginx / PF
- OSMAP
- Mailbox helper
- Dovecot / Postfix
- Rspamd / AV
- Ops / DR
BUILT FOR REAL OPERATIONS
More than webmail. A maintainable security platform.
AUTHENTICATION & SESSIONS
Password + TOTP, bounded sessions, revocation and recovery workflows.
SAFE MESSAGE RENDERING
Server-rendered UI, sanitization, remote-content blocking and bounded parsing.
MAILFLOW & FILTERING
SMTP, IMAP/LMTP, Rspamd, ClamAV, Redis and policy-controlled delivery.
MONITORING & HARDENING
PF, optional Suricata, health reporting, alerts, SBOM and patch governance.
BACKUP & DISASTER RECOVERY
Staged restores, configuration verification and repeatable recovery procedures.
REPRODUCIBLE DEPLOYMENT
Phased apply/verify workflow, QEMU validation and OpenBSD autoinstall support.
OPEN BY DESIGN
Open where it should be.
Private where it must be.
The reusable platform is auditable and reproducible. Site-specific credentials, keys, telemetry and recovery material remain outside public source control.
OSMAP
Public application
Rust, server-rendered UX and security-focused browser access.
OPENBSD MAILSTACK
Public framework
Reproducible build, validation, hardening, operations and recovery.
PRIVATE OPERATIONS
Organization-owned state
Secrets, keys, live telemetry, provider state and site-specific controls.
SECURE EMAIL, WITHOUT THE SAAS DEPENDENCY