Overview Dashboard

Real-time LAN SMTP relay activity statistics.

Total Relayed
0
Emails processed by gateway
Delivered
0
Successfully forwarded upstream
Failed / Rejected
0
Permanent or temporary failures
Active Routes
0
Sender mappings in SQLite DB

Live Relayed Mails

Sender Recipient Provider Status Time
No recent mail activity found.

Quick Reference Configuration

Point your LAN devices (scanners, printers, internal apps) to this gateway:

SMTP LAN Parameters 
SMTP Server: [YOUR_SERVER_LAN_IP]
Port:        25
Auth:        None (Subnet Authorized)
Encryption:  None / Optional

Allowed LAN ranges are configured via the LAN_SUBNETS environment variable in your docker-compose file.

Relay & Routing Rules

Configure how outgoing email domains/addresses map to M365 Graph, Google Workspace, or SMTP upstreams.

Sender Pattern Upstream Provider Status Configuration Details Actions
Loading relay rules...

Complete Mail Log

Search and inspect transmission logs and API responses.

Time Sender Recipient Subject Provider Status Details
Loading transmission logs...
Showing 0 of 0 logs

Upstream API Setup Guide

Step-by-step instructions to register your app and grant permissions in Microsoft 365 and Google Workspace.

Microsoft 365 App Registration

To relay emails via the Microsoft Graph API, you must register a Service Application in Azure AD (Microsoft Entra ID) and authorize it to send emails on behalf of tenant users.

  1. Log in to Entra ID Portal: Navigate to the Azure Portal and select Microsoft Entra ID (Azure Active Directory).
  2. Register a New App: Go to App registrations > New registration.
    • Name: LAN Mail Gateway
    • Supported account types: Accounts in this organizational directory only (Single tenant)
    • Redirect URI: Leave blank
    • Click Register.
  3. Record Identifiers: From the Overview page, copy the Application (client) ID and Directory (tenant) ID.
  4. Generate Client Secret: Go to Certificates & secrets > Client secrets > New client secret.
    • Description: mailgw-auth-key
    • Expires: Select your preference (e.g. 24 months)
    • Click Add and immediately copy the secret Value (not ID). It will be masked forever if you leave the page.
  5. Grant API Permissions: Go to API permissions > Add a permission.
    • Select Microsoft Graph > Application permissions (not Delegated).
    • Search for and select Mail.Send.
    • Click Add permissions.
  6. Admin Consent: Under the API Permissions list, click Grant admin consent for [Your Tenant] and confirm. Status should show a green checkmark.

Security Best Practice: Restricting Senders

By default, Mail.Send permits the application to send mail as *any* user in the tenant. You can restrict the app to specific users/devices (e.g. only [email protected]) by running this command in Exchange Online PowerShell:

New-ApplicationAccessPolicy -AppId "YOUR_CLIENT_ID" -PolicyScopeGroupId "[email protected]" -AccessRight SendAccess -Description "Limit mailgw relay scope"

Google Workspace Domain-Wide Delegation

To send emails on behalf of any Google Workspace account, you must create a Service Account in a Google Cloud Project and authorize it with Domain-Wide Delegation in the Workspace Admin Console.

  1. Create a Google Cloud Project: Go to the Google Cloud Console and create a project (e.g., mailgw-project).
  2. Enable the Gmail API: Navigate to the API Library, search for the Gmail API, and click Enable.
  3. Create a Service Account: Go to IAM & Admin > Service Accounts > Create Service Account.
    • Name: mailgw-service-account
    • Click Create and Continue. Skip roles assignment and click Done.
  4. Record Client ID & Download Key:
    • Click on the newly created Service Account. Under the Details tab, copy the numeric Unique ID (this is your OAuth Client ID).
    • Go to the Keys tab > Add Key > Create new key > Select JSON > Click Create. A file will download. This file contains the private key that you will upload to the mailgw dashboard.
  5. Configure Domain-Wide Delegation: Go to the Google Workspace Admin Console.
    • Navigate to Security > Access and data control > API controls.
    • Under Domain-wide delegation, click Manage Domain-wide Delegation.
    • Click Add new.
    • In the Client ID field, paste the numeric Unique ID of the service account.
    • In OAuth scopes, copy-paste: https://www.googleapis.com/auth/gmail.send
    • Click Authorize.

SMTP Ingress & Access Control

Configure whether LAN/Docker subnets can relay without credentials or require strict SMTP authentication (SASL).

SMTP Ingress Access Policy

Controls Postfix smtpd_relay_restrictions and mynetworks in real time.

Loading...
Note: Regardless of this setting, Postfix always enforces the Sender Pattern whitelist defined in Relay Rules.
Space-separated CIDR blocks permitted to send mail without SASL credentials when subnet relay is enabled.

SASL Authenticated Users (smtp_users)

Username / Mail Address Status Created At Actions
Loading SMTP users...