Security
Designed from the threat model backwards
Email infrastructure attracts abuse. Mirnint Mail's architecture starts from the failure modes — open relay, tenant leakage, key theft, SSRF, header injection — and closes them by construction, not by patching.
Never an open relay
- Postfix relays only authenticated internal workers and controlled bounce traffic
- Automated open-relay tests run in CI and after every deployment
- The contact-form API cannot choose recipients, headers or sending identity
- Callers can never set From, Return-Path, Message-ID or signing headers
Tenant isolation
- Every record belongs to exactly one organization — no implicit access paths
- API keys resolve tenancy server-side; client-supplied IDs are never trusted
- DKIM signing validates the domain belongs to the authenticated organization
- Cross-tenant access attempts are part of the automated security test suite
Secrets lifecycle
- DKIM private keys live only in Vault and controlled signing-node memory
- API keys stored as keyed HMAC digests — the clear secret is shown once
- Webhook secrets, passwords and peppers never appear in logs or traces
- Dual-selector DKIM rotation is auditable and reversible until retirement
Abuse resistance
- Independent rate limits per IP, key, project, domain, recipient and pool
- Automatic suspension on bounce or complaint spikes — audited, reversible
- CAPTCHA, honeypots, timing checks and duplicate detection on public forms
- Attachment scanning with magic-byte checks; executables blocked by default
Webhook safety
- HMAC-SHA-256 signatures over ID, timestamp and raw body
- Documented replay protection with timestamp tolerance and event dedup
- Private, loopback, link-local and metadata addresses blocked (SSRF)
- DNS resolved safely with rebinding defenses; redirects constrained
Accountability
- Append-only audit for keys, domains, templates, suppressions and access
- Support access to message content requires time-limited audited grants
- Health, readiness and metrics endpoints on every service
- Encrypted backups with tested point-in-time recovery
Data governance
Retention you control
Message bodies, recipient addresses, metadata, raw DSNs and audit events each carry their own configurable retention class. Deletion jobs are observable, idempotent and audited — and complaint suppressions never silently expire.
Data export and deletion workflows support GDPR and KVKK obligations. Sensitive values never appear in logs, traces, metric labels or API responses — that rule is enforced in code review and in the automated test suite, not just written in a policy.