A small Docker stack for inboxes you host yourself: SMTP receiver, webmail, IMAP, and a REST API — without Postfix, Dovecot, or a full mail platform.

View on GitHub Quick start 中文文档

What it is

ManyMail receives mail for your own domains and gives you three ways to read it: a browser UI, an IMAP endpoint for Thunderbird or a phone, and a REST API for scripts. Everything runs from one docker compose up on a small VPS or an ARM box.

It suits verification-code mail, disposable and catch-all addresses, and running a handful of domains off one host. It is not a corporate mail platform — see the comparison below.

ManyMail webmail inbox — self-hosted email interface with search, verification code extraction and reply

Features

Self-hosted SMTP

Receives mail on port 25 for any domain you point at it. A built-in DNS check tells you which MX, SPF and DMARC records are missing.

Webmail

Search, read, reply, compose, attachments. Mail HTML and CSS are sanitized before they render.

IMAP

Point Thunderbird or a phone client at it. An optional bridge pulls in Gmail, Outlook, QQ and 163 accounts.

REST API

DuckMail-compatible endpoints, so existing disposable-mail scripts and tools work against it.

Multi-domain and catch-all

Serve several domains from one instance. Prefixes get created on demand when you need a fresh address.

One compose file

FastAPI, Flask, Node.js and MongoDB. MIT licensed, and the data stays on your server.

How it compares

What you want	Use
Catch-all and disposable addresses on your own domain	ManyMail
Webmail, REST API and IMAP from one compose file	ManyMail
A small VPS or ARM box, no Postfix or Dovecot to tune	ManyMail
Company mailboxes, CalDAV, ActiveSync, Rspamd, quotas	Mailcow, docker-mailserver, Mail-in-a-Box

Quick start

curl -fsSL https://raw.githubusercontent.com/margbug01/ManyMail/master/install.sh | bash

The installer asks for your domain and a password, writes .env with random secrets, pulls prebuilt amd64 / arm64 images and starts everything. It ends with a DNS check that prints the MX, A, SPF and DMARC records you still need. Manual setup, the API reference and the architecture diagram are in the README.

Before you put it on the internet

Port 25 is a public listener. Read the production hardening guide, replace every placeholder secret in .env, keep AUTO_CREATE_ACCOUNTS=0, and put the viewer behind TLS. Vulnerability reports go through the security policy.