Platform: go-emailservice-ads

go-emailservice-ads is a complete mail server written in Go: it receives mail over SMTP, applies policy, stores it, and serves it back over IMAP (and JMAP). It is multi-domain, MIT-licensed, and runs as a single binary plus a Postgres database. It is the server behind msgs.global.

The pipeline, end to end

A message travels through five stages. Each is a distinct subsystem you can reason about and configure independently.

Listeners & ports

Default ports (all configurable):

Configuration

The server reads a single config.yaml. The load-bearing sections:

server:
  local_domains:            # domains this server accepts mail for
    - example.com
  max_message_bytes: 52428800

api:
  rest_addr: ":8080"
  grpc_addr: ":50051"
  api_keys:                 # bearer keys for the REST API
    - name: "Web Platform"
      key: "…"
  allowed_ips: ["127.0.0.1"]
  require_ip_auth: true     # IP allowlist in addition to the key

imap:
  addr: ":1143"
  tls_mode: starttls

auth:
  default_users:            # mailboxes loaded at startup
    - username: "hello@example.com"
      password: "…"
      email:    "hello@example.com"
  # Master (proxy) login for trusted control-plane services:
  master_user: "gateway"
  master_password: "…"
  master_allowed_ips: ["10.0.0.5"]   # required; empty = disabled (fail closed)
  master_separator: "*"

sso: { enabled: false }
jmap: { enabled: false, addr: ":8081" }

Master (proxy) auth lets a trusted service log into any mailbox as <user>*<master_user>. It is off unless a user, a password, and a non-empty source-IP allowlist are all set, uses a constant-time credential check, and fails closed — so it is safe to expose only to a specific internal host.

The authentication model

Three distinct credentials, for three distinct jobs:

Mailbox login (IMAP/SMTP-AUTH)

Users defined in auth.default_users are loaded into the mailbox store at startup; each authenticates with its own password. Master (proxy) auth lets an allowlisted service read any mailbox.

REST API (bearer)

The management API authenticates with a bearer token plus an optional IP allowlist (require_ip_auth). Failures return 401.

SSO

When sso.enabled is set, external identities authenticate through the configured provider.

The REST API

The server exposes an operational REST surface on :8080. Public: GET /health, /ready, /api/v1/health, /api/v1/version, and Prometheus /metrics. Authenticated: /api/v1/queue/stats and /queue/pending, /api/v1/policies (list/reload/stats), /api/v1/dlq/list and /dlq/retry/…, /api/v1/message/…, and /api/v1/replication/status.

Mailbox, user, domain and alias administration is done through the adsemailadm CLI (below) rather than the HTTP API.

Command-line tools

Build & run

git clone https://github.com/afterdarksys/go-emailservice-ads.git
cd go-emailservice-ads
go build -o bin/goemailservices ./cmd/goemailservices
go build -o bin/adsemailadm    ./cmd/adsemailadm

./bin/goemailservices --config config.yaml

Filtering policy is written in mailscript — see the mailscript language guide.