How it's built
Instead of one server doing everything, we split the system in two: a gateway that handles public traffic, and a storage machine that holds the actual mail and never takes a connection from the open internet.
The two machines
The gateway
This is mail.mailed.pl, the public entry point. It terminates TLS 1.3, handles incoming SMTP on 25, 465 and 587 and IMAP on 993, checks senders against Spamhaus DQS, and routes traffic without masking the sender's real IP.
Public facing. No mail is stored here.
The vault
A separate machine that holds the actual mailboxes, attachments and database. Its drives are encrypted at rest, and it has no public network interface at all. Only the gateway can reach it, over a private link.
Not reachable from the internet.
Why we don't mask the sending IP
Most reverse proxies rewrite the source address of every connection they forward. When that happens, Postfix and Rspamd only ever see the proxy's address, not the sender's. SPF checks and spam filters end up working against the wrong IP, which causes both false positives and false negatives.
Our gateway routes connections instead of masking them, so the real client address reaches Postfix and Rspamd unchanged. That keeps SPF accurate and spam filtering honest.
How the vault is locked down
A few things we hold ourselves to:
- No public IP. The vault isn't reachable from outside. Inbound connections from the public internet are blocked at the network edge, not just by a firewall rule on the host.
- Encryption at rest. The NVMe drives holding mail and the database are encrypted at the block level with AES-256-XTS.
- Process isolation. Dovecot runs in unprivileged, chrooted processes, so a bug in one mailbox's handling can't reach another's files.
- Everything in Warsaw. The vault hardware is physically installed in our datacenter in Warsaw, under Polish jurisdiction.
Jurisdiction
Mailed is run by an independent Polish company. We have no US parent and no US subsidiary, and all our servers are in Warsaw, so we operate under Polish law and the GDPR (Regulation (EU) 2016/679). That also means we're outside the reach of US orders like FISA Section 702 requests or the US CLOUD Act, since there's no US entity for those to be served on.