- Home
- Email Security Gateways
- Hermes Secure Email Gateway
Hermes Secure Email Gateway
What it is
Hermes Secure Email Gateway is a self-hosted Docker Compose stack for email security, mail hosting, encryption and Nextcloud collaboration. It can act as a gateway in front of Microsoft 365, Google Workspace, Exchange or Postfix, run as a full mail server, or use both approaches in a hybrid setup. Inbound filtering uses Postfix postscreen and RBL checks, followed by Amavisd-new-coordinated SpamAssassin and ClamAV scanning. Hermes checks SPF, handles DKIM signing and verification, enforces and aggregates DMARC, and signs and verifies ARC. Encryption options include SMTP TLS, S/MIME, PGP, encrypted PDF fallback and Dovecot mail-crypt encryption at rest. Full-server mode includes mailboxes, IMAPS, POP3S, Submission, LMTP, quotas, shared mailboxes and Sieve rules. Bundled Nextcloud provides file sync, webmail, calendars and contacts, with CalDAV and CardDAV. Authelia adds single sign-on and multi-factor options including TOTP, WebAuthn and Duo Push. Hermes requires Linux with Docker Engine 24.0 or later and Docker Compose v2. Community Edition is free and open source; Pro is $750 a year per server and has a free 30-day trial.
For and against
For
- Can run as a gateway, full mail server or hybrid.
- Includes SpamAssassin and ClamAV scanning.
- Supports several email authentication and encryption options.
- Bundles Nextcloud and Authelia.
Against
- Requires Linux, Docker Engine 24.0 or later, and Compose v2.
- Direct vendor support requires eligible Pro coverage or purchased incidents.
- Malware sandboxing is not available.
- Pro costs $750 a year per server.
The verdict
Hermes combines email filtering, hosting, encryption and collaboration in a self-hosted deployment. Its Linux and Docker requirements and support arrangements are important considerations for teams evaluating the free Community Edition or per-server Pro license.
Who it suits
Hermes is presented for SMBs, MSPs, self-hosters, privacy-focused teams and organizations adding a gateway to existing mail services. It suits teams able to run the required Linux and Docker environment.
Plans and prices
Community Edition
full gateway and mail-server stack · core security and encryption · mailbox hosting · administration
Read 15 Oct 2026 · github.com
Pro Edition
Link Guard · disclaimers · organizational signatures · intrusion-prevention UI
Read 15 Oct 2026 · hermesseg.io
On the record
- Audience
- The site presents Hermes for SMBs, MSPs, self-hosters, privacy-focused teams, and organizations adding a gateway in front of Microsoft 365 or Google Workspace.hermesseg.io · read 7 Oct 2026
- Collaboration integrations
- The stack bundles Nextcloud for file sync, webmail, calendars, and contacts, with CalDAV and CardDAV support.hermesseg.io · read 7 Oct 2026
- Deployment
- It can run as a gateway in front of Microsoft 365, Google Workspace, Exchange, or Postfix, as a full mail server, or in hybrid mode.hermesseg.io · read 7 Oct 2026
- Deployment modes
- It supports gateway deployment ahead of Microsoft 365, Google Workspace, Exchange or Postfix, full mail-server deployment, and mixed gateway/mail-server deployments.github.com · read 15 Oct 2026
- Documentation depth
- Online documentation is organized into installation/reference material, a 60-page administrator guide and an 11-page user guide.github.com · read 15 Oct 2026
- Email authentication
- The stack checks SPF, signs and verifies DKIM, enforces and aggregates DMARC, and signs and verifies ARC.hermesseg.io · read 15 Oct 2026
- Encryption
- Hermes supports SMTP TLS, S/MIME, PGP, encrypted-PDF fallback and Dovecot mail-crypt encryption at rest.hermesseg.io · read 15 Oct 2026
- Filtering
- Inbound mail passes through Postfix postscreen and RBL checks, then Amavisd-new orchestrates SpamAssassin and ClamAV scanning.hermesseg.io · read 7 Oct 2026
- Groupware
- Nextcloud supplies file synchronization, webmail, calendars and contacts through CalDAV and CardDAV.hermesseg.io · read 15 Oct 2026
- Identity and MFA
- OpenLDAP and Authelia provide directory services, SSO and MFA options including TOTP, WebAuthn and Duo Push.github.com · read 15 Oct 2026
- Installation time
- The installer documentation estimates 10 to 30 minutes on a fresh host, mainly for image downloads and container builds.github.com · read 15 Oct 2026
- Integrations
- Published integration targets include Microsoft 365, Google Workspace, Exchange, Postfix, Nextcloud, LDAP and Active Directory.hermesseg.io · read 15 Oct 2026
- Licence
- The Community Edition is licensed under GNU AGPLv3; proprietary Pro files are governed by a commercial EULA.github.com · read 15 Oct 2026
- Limit: CipherMail credentials
- A reported issue says the CipherMail console used a separate stock admin/admin credential that Hermes did not automatically rotate.github.com · read 15 Oct 2026
- Limit: disk monitoring
- An open issue reports no alert when disk space fills, with mail deferral appearing as the first symptom.github.com · read 15 Oct 2026
- Limit: documentation usability
- An open issue says the administrator documentation reads like reference material for builders instead of step-by-step instructions for users.github.com · read 15 Oct 2026
- Limit: operational burden
- The product requires customers to operate Linux, Docker, firewall rules, DNS, storage and mail infrastructure themselves.hermesseg.io · read 15 Oct 2026
- Limit: scheduled-task control
- An open issue reports that scheduled-task schedules are displayed but cannot be changed in the interface.github.com · read 15 Oct 2026
