The open-source Amazon SES replacement.
A self-hosted mail delivery engine that speaks the Amazon SES v2 API. Keep your SES code, set up your own sending IPs and domains, and deliver straight from your servers.
Nitrosend's mail delivery engine, open sourced.
Built in Rust. Self-hosted. Apache-2.0.
Drop-in
One line changes: the endpoint. Your application's keys become an access key of the engine's own.
SMTP clients send to it too, with STARTTLS and a login. Tested against the official AWS SDKs for Python, JavaScript and Ruby. Compatibility lists every operation.
ses = boto3.client(
"sesv2",
+ endpoint_url="https://mta.example.com",
region_name="us-east-1",
)
sent = ses.send_email(...)
print(sent["MessageId"])
MessageId 00c4a9a286e00000
Install it, point your DNS, and nitromta doctor checks every record a receiver looks at: reverse DNS, SPF, DKIM, DMARC and the bounce domain, with the exact record to publish for any that's missing.
Benchmarks
Each system on 4 CPUs of the same AWS bare-metal server, committing every message to disk before accepting it: 16 KiB messages, DKIM-signed, TLS in and out.
1.35 million messages across nine runs, every one delivered once and DKIM-verified.
The highest rate each sustained, median of three runs, on an AWS c7gd.metal with each system's queue on local NVMe. Run it yourself with cargo harness quick. The method and every run.
One Rust binary on your own Linux host, with its store in SQLite and a systemd unit.
SendEmail, SendBulkEmail, templates, identities, configuration sets, tenants, the suppression list, dedicated IPs and SES-shaped events through SNS.
A message is accepted only once it is on disk. Tested by cutting the power at every I/O operation, and by moving a store to a new host.
New IPs warm up receiver by receiver from 50 messages a day. Per-provider connection limits and cooldowns, automatic suppression, DKIM signing, and TLS verified by MTA-STS and DANE.
nitromta explain says why any message is waiting: its last reply, the rule it matched, and the cooldown or cap holding it. Health checks and Prometheus metrics.
Personal data under the installation's key, or each tenant's mail under a key of its own, so removing a tenant erases it.
Refuses to run as root, seals its stored secrets apart from its store, bounds every connection, and runs under a hardened systemd unit.
Try it
Capture mode runs the whole engine locally and shows each message in a browser instead of sending it.
Send with the code above, then open 127.0.0.1:9090/capture. The capture quickstart has every step.
brew install nitrosend/tap/nitromta nitromta setup --config config.toml --capture nitromta run --config config.toml
gh release download -R nitrosend/nitromta \ -p '*_amd64.deb' sudo apt install ./nitromta_*_amd64.deb nitromta setup --config config.toml --capture nitromta run --config config.toml
One email per release: what's new and how fast it runs.