1. Protocols & High-Speed Transport

ESMTP · IMAP4rev2 · JMAP · ManageSieve · Transactional REST

ESMTP (Ports 25, 465, 587): High-throughput streaming parser, CHUNKING (BDAT), SIZE, PIPELINING, 0 ms SNI STARTTLS, async tarpit & anti-SMTP-smuggling guards.
IMAP4rev2 & IMAP4rev1 (143, 993): SPECIAL-USE, QUOTA, NAMESPACE, UIDPLUS, CONDSTORE, MOVE & < 5 ms zero-polling IDLE push.
JMAP Mail (RFC 8620 / 8621): Result-reference pipelining (#ids) fetches folders, query & bodies in 1 HTTP roundtrip + EventSource push.
Transactional HTTP API: POST /api/v1/send with scoped API keys, Idempotency-Key protection, and smart provider-throttled MX workers.

2. Email Auth, Anti-Spam & Port Hardening

SPF · DKIM · DMARC · ARC · DANE · MTA-STS · Anti-Spam · ClamAV

Dual-DKIM & ARC Chain: Simultaneous Ed25519-SHA256 + RSA-2048 signing with 1-click key rotation and RFC 8617 ARC chain sealing.
DANE & MTA-STS: RFC 7672 TLSA verification, built-in /.well-known/mta-sts.txt hosting & visual DMARC/TLS-RPT analyzer.
Adaptiver Anti-Spam & Virenschutz: Adaptive spam classifier trains instantly on user Junk moves + /24 & /64 Smart Greylisting + ClamAV streaming antivirus.
Konsequenter Überlast- & Archivbomben-Schutz: Global & per-IP connection limits, hard decompression-bomb caps, and strict protocol parser depth limits.

3. Deduplicated Store, GoBD & OCR Search

SQLite WAL · PostgreSQL · S3 Object Lock · ZUGFeRD · Scan OCR

Dual-SQL + SHA-256 Zstd Blobs: Choose zero-config SQLite (WAL + FTS5) or high-scale PostgreSQL paired with SHA-256 deduplicated Zstd blobs on NVMe, S3, or Hybrid.
GoBD / WORM Archivierung: Immutable S3 Object Lock (COMPLIANCE), Legal Hold, and dedicated Auditor role (inspects without mutating read status).
3-Stufen Dokumenten- & OCR-Suche: Extracts MIME, PDFs, Office docs & ZUGFeRD XML immediately and runs automated OCR on scanned receipts and image PDFs.

4. OpenTelemetry, Logs, Identity & Ops

OpenTelemetry · JSONL-Logs · Passkeys · OIDC · SCIM 2.0 · Docker & Windows

OpenTelemetry & Strukturierte Logs: Native OTLP export (Traces, Metrics & structured Logs to Grafana Tempo/Loki, Prometheus, Datadog & Elastic), /metrics, daily JSONL log rotation & live Admin UI.
Zero-Trust Auth & SCIM 2.0: WebAuthn/FIDO2 Passkeys, strict 2FA across all ports, per-device App Passwords, plus OIDC & SCIM 2.0 for Entra ID, Keycloak, Okta & Authentik.
Autoconfig, Autodiscover & 5s Handy-QR: Built-in Mozilla Autoconfig (Thunderbird/Android) & Microsoft Outlook Autodiscover (XML/JSON) plus PKCS#7-signed Apple .mobileconfig QR profile with per-device App Password.
Docker Compose & Windows-Service: Deploy via Docker Compose, Kubernetes Helm, or natively as a first-class Windows Server Service without Docker.

Visual Capability Tour

Detailed screenshots across Admin Cockpit, Observability, GoBD & Webmail

Every interface shown below ships built-in with SharpMailserver at zero extra cost and with zero third-party plugins.

https://mail.sharpmailserver.com/admin/

Live Telemetry & Active SMTP Queue (Light Mode)

Default crisp Light Mode: real-time memory chart, live protocol event trace, and monitored outbound MX delivery queue.

https://mail.sharpmailserver.com/admin/#domains

Multi-Tenant Domains, 1-Click Dual-DKIM & S3 Object Lock

Manage unlimited domains, rotate Ed25519 and RSA-2048 DKIM keys in one click, and copy ready-to-publish DNS records.

https://mail.sharpmailserver.com/admin/#compliance

GoBD / WORM Compliance Archive & Legal Hold

Immutable 10-year retention locks (COMPLIANCE), Legal Hold, and read-only audit search across PDFs, ZUGFeRD e-invoices, and OCR scans.

https://mail.sharpmailserver.com/admin/#otel-logs

OpenTelemetry (OTLP), Structured Server Logs & Security Monitor

W3C TraceId-correlated server logs, daily JSONL rotation, OTLP export (Traces, Metrics, Logs) to Grafana/Loki/Tempo, and central anomaly capture.

https://mail.sharpmailserver.com/admin/#dmarc

Graphical DMARC & TLS-RPT Analyzer + OpenMetrics (/metrics)

Visually analyzes DMARC aggregate reports (.xml/.gz/.zip) and RFC 8460 TLS-RPT JSON alongside live Prometheus /metrics.

https://mail.sharpmailserver.com/mail/

SharpMail Webmail PWA with SPF/DKIM/DMARC & ZUGFeRD Verification

Built-in zero-PHP Webmail PWA featuring cryptographic trust banners, sub-10ms search, 15 accent themes, and Undo-Send.

https://mail.sharpmailserver.com/mail/#mobile-qr

5-Second Smartphone Onboarding via Signed QR Code

One camera scan on iPhone, iPad, or Mac installs a PKCS#7/CMS-signed .mobileconfig profile with an isolated per-device App Password.

https://mail.sharpmailserver.com/admin/#migration

1-Click Windows hMailServer Importer & Live IMAP Sync

Imports complete Windows hMailServer directories (domains, accounts, aliases, Data\*.eml) or delta-syncs live TLS IMAP/Exchange servers.

Database Architecture & Document Intelligence

PostgreSQL or SQLite WAL paired with sub-millisecond OCR, PDF & ZUGFeRD search

SharpMailserver cleanly separates transactional metadata from content-addressed blobs and automatically indexes PDFs, EN 16931 e-invoices, and scanned image attachments in the background.

Relational Metadata & Hybrid SHA-256 Zstd Blob Store

PostgreSQL · SQLite WAL · NVMe · AWS S3 · Azure Blob · GCS · MinIO

PostgreSQL für Enterprise-Cluster: Optimized B-tree and GIN full-text indexes, read replicas, and multi-node high availability for tens of thousands of mailboxes on self-managed PostgreSQL, AWS RDS, Azure, or Cloud SQL.
SQLite im WAL-Modus für Single-Server & NAS: Zero-administration single-node operation with built-in FTS5 trigram indexing. Ideal for Windows Services, Proxmox LXC containers, NAS systems, and branch servers.
Globale SHA-256-Deduplizierung + Zstandard: A 20 MB attachment sent to 40 internal recipients is stored physically once with Zstandard compression, cutting disk and S3 storage consumption by 55% to 62%.
Revisionssicherer S3 Object Lock (WORM): Hybrid tiering caches hot messages on local NVMe flash while locking long-term compliance archives immutably in S3-compatible object storage.

3-Stage Full-Text, ZUGFeRD & OCR Search Pipeline

Finds invoice IDs, contracts & scanned paper receipts in < 8 ms

Stufe 1 (Echtzeit-MIME & Header-Index): Headers, participants, Message-IDs, and normalized text/HTML bodies become searchable at the exact millisecond of delivery across Webmail, JMAP, and IMAP SEARCH.
Stufe 2 (Natives PDF, Office & ZUGFeRD / XRechnung): Natively extracts multi-page PDF text, DOCX/XLSX documents, and structured EN 16931 e-invoice XML fields (invoice numbers, IBANs, VAT IDs, line items, totals).
Stufe 3 (Asynchrone OCR-Texterkennung für Scans): Scanned paper mail, photographed receipts, and image-only PDFs (PNG, JPEG, TIFF, scanned PDFs) are processed asynchronously by an isolated OCR worker queue for full-text discovery.
GoBD-Prüfer-Suche ohne Veränderung: Tax auditors search across mail bodies, ZUGFeRD XML, and OCR-indexed scans in strict read-only mode without ever altering user \Seen flags.

Verified Benchmarks & Resource Footprint

Minimal memory footprint. Predictable high throughput under load.

Built on streaming network I/O, reusable memory buffers, and strict resource limits, SharpMailserver keeps RAM flat and predictable even under heavy concurrency.

~58 MB

Idle RAM (Complete Stack)

Includes ESMTP, IMAP4rev2, JMAP, ManageSieve, Webmail PWA, Admin Cockpit & ACME.

1.450+ / s

SMTP Inbound Messages/sec

Measured on 4 vCPU NVMe VM including SPF/DKIM/DMARC verification, SHA-256 dedup & Zstd.

< 8 ms

Full-Text & OCR Search (p95)

Queried across 500,000 indexed messages, multi-page PDFs, and ZUGFeRD e-invoices.

-62 %

Lower Disk & S3 Storage

Real-world corporate mailbox reduction via cross-account SHA-256 deduplication + Zstd.

Typical Memory Footprint Comparison (250 mailboxes including Webmail & Anti-Spam)

Runs effortlessly on an entry-level 2 GB cloud VPS, office NAS, or Raspberry Pi.

SharpMailserver (Kompletter Stack, aktiv)~145 MB bis 240 MB RAM

Postfix + Dovecot + Rspamd + ClamAV + Redis + Webmail (Docker-Stack)~2.600 MB bis 4.200 MB RAM

Microsoft Exchange Server On-Premises8.192 MB bis 16.384+ MB RAM

Operating Systems, Kubernetes & Cloud Ecosystem

Runs everywhere: Docker Compose, Windows Service, Linux, macOS, Kubernetes & EU Clouds

100% On-Prem / Private Cloud (DE) / Container: run via Docker Compose, natively as a Windows Service or Linux daemon without Docker, on macOS Apple Silicon, in Kubernetes, or on any sovereign European cloud or global hyperscaler.

Native Operating Systems (No Docker Needed)

First-class native system daemons for both x86_64 and ARM64 architectures:

Windows Server 2019 / 2022 / 2025 (Service) Debian / Ubuntu LTS (systemd) RHEL / AlmaLinux / Rocky / SUSE macOS (Apple Silicon M1-M4 & Intel, launchd) Raspberry Pi OS (ARM64)

Kubernetes & Container Runtimes

OCI-compliant multi-arch images with /healthz probes, /metrics for Prometheus & PROXY protocol v2:

Kubernetes & Helm Charts Docker & Docker Compose Podman (Rootless) containerd & CRI-O Red Hat OpenShift SUSE Rancher & K3s HashiCorp Nomad Proxmox VE (LXC & KVM)

Global Hyperscalers & Sovereign EU Clouds

Validated with managed PostgreSQL, TCP load balancers, and immutable S3/Blob storage across:

AWS (EC2, EKS, ECS, RDS, S3) Microsoft Azure (AKS, VMs, Blob WORM) Google Cloud / GCP (GKE, Cloud SQL, GCS) Oracle Cloud (OCI) Hetzner (DE / FI) IONOS Cloud (DE) OVHcloud (EU) STACKIT & Open Telekom Cloud (DE) Scaleway · Exoscale · UpCloud netcup · Strato · ALL-INKL · Hostinger

Docker & Docker Compose Examples Windows Server Native Service Guide Proxmox, Synology, UGREEN, Unraid & Pi Guides Hetzner, netcup, IONOS, Strato & OVHcloud Guides

RFC & Compliance Matrix

Supported RFCs, Cryptography & Storage Backends

ESMTP & Delivery

RFC 5321, RFC 3207 (STARTTLS), RFC 8314 (Implicit TLS 465), RFC 3030 (BDAT CHUNKING), RFC 1870 (SIZE), RFC 4954 (AUTH PLAIN/LOGIN), RFC 3464 (DSN), RFC 7505 (Null-MX), SRS Rewriting.

IMAP4rev2 & JMAP

RFC 9051 (IMAP4rev2), RFC 3501, RFC 2177 (IDLE < 5 ms), RFC 6154 (SPECIAL-USE), RFC 2087 (QUOTA), RFC 6851 (MOVE), RFC 7162 (CONDSTORE), RFC 8620 & 8621 (JMAP Core + Mail + SSE).

Sieve & Onboarding

RFC 5228 (Sieve Engine: fileinto, redirect, reject, vacation), RFC 5804 (ManageSieve Port 4190), Visual Rule Compiler, Mozilla Autoconfig, MS POX Autodiscover, PKCS#7 Apple .mobileconfig.

Trust & Anti-Spam

RFC 7208 (SPF), RFC 6376 & 8463 (DKIM RSA-2048 + Ed25519), RFC 7489 (DMARC), RFC 8617 (ARC), RFC 8461 (MTA-STS), RFC 8460 (TLS-RPT), RFC 7672 (DANE TLSA), Adaptive Anti-Spam + ClamAV.

Storage & OCR Search

SQLite WAL + FTS5 OR PostgreSQL full-text & vector indexing. SHA-256 Content-Addressed Zstd Blobs on NVMe, AWS/MinIO/IONOS/Hetzner S3, or Hybrid with S3 Object Lock (COMPLIANCE).

OpenTelemetry & Security

OpenTelemetry OTLP (Traces, Metrics, Logs), OpenMetrics /metrics, rotating JSONL Server & Security Logs, Argon2id, FIDO2 Passkeys, TOTP 2FA, OIDC SSO, RFC 7644 SCIM 2.0 & CIDR Firewall.

Open Pricing Calculator Docker Compose & Windows Service Guides

40+ enterprise capabilities in one unified server platform