Hermes SEG is now a complete self-hosted email platform — and it runs on Docker.

Hermes Secure Email Gateway started as a security gateway you put in front of someone else's mail server. It has grown into something bigger: a complete self-hosted email platform — a full mail server, groupware (calendars, contacts, file sync, webmail), single sign-on, and the security layer that started it all, in one install. And as of v260612 — our first public Docker release — you bring the whole stack up with a single docker compose up -d instead of a bare-metal Ubuntu build. Run Hermes as your entire mail platform, or keep it in front of an existing one.

What Hermes is now

• Still a secure email gateway — the original job hasn't gone anywhere. Run Hermes purely as a filtering gateway in front of Microsoft 365, Google Workspace, or any existing mail server, and nothing else changes.
• A full mail server — Dovecot 2.4 mailbox hosting over IMAPS / POP3S / submission / LMTP, per-domain and per-mailbox quotas, shared mailboxes and folders, and user-defined Sieve rules.
• Groupware built in — Nextcloud delivers webmail, calendars, contacts, and file sync, all behind one login.
• One Docker stack — 19 containers, a single compose file, no host-level mail services. Free and open source (AGPLv3).

Security that's always free

The entire security stack ships in the free Community Edition — it's never behind the paywall.

• Spam & malware filtering — Postfix postscreen, RBLs, and an allow/block list up front; SpamAssassin and ClamAV behind it with ten signature feeds (SaneSecurity, URLhaus, MalwarePatrol and more) updated on a schedule. Per-user quarantine you can search, release, and train from.
• Encryption as table stakes — SMTP TLS in transit, S/MIME and PGP end-to-end, encrypted-PDF delivery for recipients without keys, and Dovecot mail-crypt encrypting every mailbox at rest. Internal CA managed from the console.
• Email authentication done right — SPF, DKIM (signed outbound and verified inbound), DMARC with report aggregation, and ARC to keep forwarded mail's auth chain intact — all managed from the UI, no shell rituals.
• Identity, MFA & SSO — Authelia single sign-on across the console, user portal, webmail, and Nextcloud; TOTP / WebAuthn / Duo Push; app passwords for IMAP/SMTP/DAV clients; Have-I-Been-Pwned checks that block breached passwords at change time.

Hermes Pro — the operational add-ons

Pro is an optional commercial layer, licensed per server, for production and managed-service deployments. Seven features on top of CE — your security stays free either way.

• Link Guard — time-of-click link protection. Inbound links are rewritten and their reputation checked at the moment of the click (URLhaus, OpenPhish, optional Safe Browsing / VirusTotal), catching links weaponized after delivery — the defense you'd normally buy from Proofpoint or Mimecast, fully self-hosted.
• Let's Encrypt automation — hands-off ACME issuance and renewal for the admin console and per-domain mail TLS.
• LDAP RemoteAuth — per-domain pass-through authentication against Active Directory or other external LDAP.
• Intrusion Prevention & Console firewall — web UIs to tune Fail2ban jails and lock the admin console to trusted networks, no SSH required.
• Disclaimers & organizational signatures — centrally-managed, per-domain outbound footers and signatures applied at the milter level, so every message is covered regardless of client.

Thanks for following along — early-adopter feedback shapes the next release directly.
— The Hermes SEG team

First time hearing from us at this address? We've moved our newsletter to a new system — same Hermes SEG updates, nothing else changes. Unsubscribe anytime below.