Operational

Mail Server Architecture

Self-hosted email infrastructure for viktorbarzin.me on Kubernetes with CrowdSec protection

docker-mailserver 15.0.0 | Updated 2026-04-12
9
DNS Records
10m
Probe Interval
30m
Alert Threshold
5
Security Layers
Local
Traffic Policy
Inbound Mail Flow
📧
Sender MTA
MX lookup
:25
🌐
mail.viktorbarzin.me
176.12.22.76
NAT
🛡
pfSense
port 25 fwd
10.0.20.202
⚖
MetalLB
ETP: Local
📬
Postfix
+ CrowdSec
🔍
Rspamd
spam/DKIM/DMARC
📥
Dovecot
IMAP :993
Outbound Mail Flow
📬
Postfix
relayhost
SASL+TLS :587
🚀
Mailgun EU
smtp.eu.mailgun.org
📧
Recipient
IP reputation handled
DNS Records
TypeNameValueStatus
MXviktorbarzin.memail.viktorbarzin.me (pri 1)OK
Amail.viktorbarzin.me176.12.22.76 (DNS-only)OK
AAAAmail.viktorbarzin.me2001:470:6e:43d::2OK
SPFviktorbarzin.mev=spf1 include:mailgun.org -allHard Fail
DKIMs1._domainkeyRSA 1024-bit (Mailgun outbound)OK
DKIMmail._domainkeyRSA 2048-bit (Rspamd signing)OK
DMARC_dmarcp=quarantine; pct=100OK
MTA-STS_mta-stsv=STSv1; id=20260412OK
TLSRPT_smtp._tlsrua=mailto:postmaster@viktorbarzin.meOK
⚠
PTR Mismatch: Reverse DNS returns 176-12-22-76.pon.spectrumnet.bg (ISP-assigned) instead of mail.viktorbarzin.me. ISP-controlled, cannot fix. Minimal impact — Gmail/Outlook rely on SPF/DKIM/DMARC.
Security Layers

🛡 CrowdSec

  • crowdsecurity/postfix + dovecot collections
  • Real client IPs via ETP: Local on 10.0.20.202
  • Automatic brute-force detection & ban

🔍 Rspamd

  • Spam filtering + phishing detection
  • DKIM signing (selector: mail, 2048-bit)
  • DMARC verification on inbound
  • Auto-learns from Junk folder

🚦 Postfix Rate Limiting

  • 10 connections/min per client
  • 30 messages/min per client
  • Now effective with real IPs (ETP: Local)

🔒 TLS Enforcement

  • Let's Encrypt wildcard cert
  • MTA-STS enforces TLS for inbound
  • TLSRPT for failure reporting
  • STARTTLS on SMTP, SSL on IMAP
Monitoring & Alerts
📊
MailServerDown
No replicas for 5m
📧
EmailRoundtripFailing
Probe failing for 30m
⏱
EmailRoundtripStale
No success in >40m
❓
EmailRoundtripNeverRun
Metric absent for 40m
MonitorTypeTargetInterval
E2E Roundtrip ProbeCronJobMailgun API → MX → IMAP*/10 * * * *
SMTP ExternalUptime Kuma176.12.22.76:2560s
Dovecot ExporterPrometheus:9166/metricsscrape
Terraform Stacks
StackPathResources
Mailserverstacks/mailserver/Namespace, Deployment, Service, CronJob, PVCs
DNSstacks/cloudflared/MX, SPF, DKIM x2, DMARC, MTA-STS, TLSRPT
Monitoringstacks/monitoring/Prometheus alert rules
CrowdSecstacks/crowdsec/postfix + dovecot collections, log acquisition