webmailMaquita: Cliente webmail open-source (AGPLv3) con eDiscovery y DLP para Postfix/Dovecot

Wilson Arguello — Mon, 14 Sep 2026 22:47:35 +0000

Hi everyone!

I’d like to share with the community an open-source project we recently released under the AGPL-3.0 license: webmailMaquita.

It is a webmail and collaboration suite designed to address a very specific need: providing advanced compliance capabilities such as eDiscovery, legal hold, and DLP on self-hosted mail servers based on Postfix + Dovecot, without relying on per-user commercial licenses or cloud suites.

💡 Why did we build it?

In production environments running on Postfix + Dovecot, Roundcube was too limited for our auditing and interface needs, while advanced DLP and compliance features are usually reserved for expensive enterprise licenses.

We decided to build an open-source layer that provides these capabilities while keeping the infrastructure under our own control.

🚀 Main features
✉️ Webmail and Interface

Stack: Built with React + FastAPI, with support for conversation threads, labels, Sieve rules, and full-text search.

Productivity: Calendar and contacts via CalDAV/CardDAV, Kanban tasks, and chat.

Security: Two-factor authentication (2FA TOTP) and email encryption at rest using Dovecot mail_crypt.

🛡️ Email Security

Authentication: SPF, DKIM, DMARC, and Rspamd.

Anti-spoofing: Detection of lookalike domains, homoglyphs, and impersonation of internal roles.

Outbound DLP: Detection of sensitive data such as national ID numbers, tax IDs, IBANs, and payment card information. It also works with Outlook and mobile clients through a milter.

Active defense: Automatic detection and containment of compromised accounts generating high-volume outbound email.

📊 Compliance and eDiscovery

Forensic search: Search across all mailboxes, legal holds, and custodian management.

Digital signatures: Email exports signed with GPG and timestamped using RFC 3161.

Traceability: Logging of 39 event types with end-to-end correlation:

Postfix → Rspamd → Dovecot → user action

🧰 Additional tools included in the repository

Drive and local AI: Shared drives, OnlyOffice integration, and an optional 100% local AI module using Ollama/Whisper for dictation and suggestions without sending data to external APIs.

⚙️ Deployment

It runs natively on Debian using a reproducible installation script.

🔍 Current status and limitations

We want to be transparent about what is still in progress:

Automatic retention: Policies can already be defined through the interface, but the automated purge/archive process is still under development.

Quarantine: Currently managed by administrators.

Scale: Tested with approximately 300 mailboxes and more than 100,000 emails in a real production environment, but not yet validated in deployments with thousands of concurrent users.

🤝 Source code and repository

🔗 https://github.com/wilsongabriel30/webmailMaquita

The project is fully open source.

We would especially appreciate:

testing on clean Debian installations;
security reviews;
bug reports;
feedback on the architecture;
feedback on the roadmap;
contributions from developers and sysadmins.

We hope it can be useful to others looking for a self-hosted, privacy-focused alternative for email infrastructure and compliance.

DEV Community: Wilson Arguello

webmailMaquita: Cliente webmail open-source (AGPLv3) con eDiscovery y DLP para Postfix/Dovecot