Proxmox Mail Gateway: email filtering you control
Proxmox Mail Gateway checks every message before it reaches your mail server. inett installs it, builds the rule set with you and keeps it up to date.
The problem
Phishing still reaches inboxes, while legitimate messages disappear without trace. When the filter is built into the mail server or bought as a cloud service, administrators often cannot see why a message was rejected. If that single filter stops, no mail arrives at all.
A cloud filtering service also means every message passes through someone else’s infrastructure. For public bodies and firms handling confidential correspondence, that is often not acceptable.
What inett does
Proxmox Mail Gateway is a mail proxy based on Debian and published under the GNU AGPLv3. It sits between the internet (or your firewall) and your mail server. Inbound mail arrives on port 25, is checked, and clean messages are relayed to your mail server. Your mail server sends outbound mail to port 26 on the gateway, which checks and delivers it. It works with Exchange, Postfix and other SMTP servers.
The gateway combines several layers:
- SMTP-level checks. Receiver verification against your mail server, SPF, DNS blocklists and greylisting reject much of the spam before the message is even accepted.
- Spam detection. SpamAssassin assigns each message a score. You decide at which score a message is tagged or held.
- Virus scanning. ClamAV scans message content and attachments.
- Rule system. Each rule combines objects from four types: Who (senders, recipients, domains, LDAP groups), What (content, attachment type, spam score), When (time frames) and Action (accept, block, quarantine, remove attachments, notify). A rule applies to inbound mail, outbound mail or both, and has a priority.
- Quarantine. Spam can go to a quarantine that users manage themselves, with a daily spam report. Viruses and removed attachments go to separate quarantines for administrators.
- Message tracking. The Message Tracking Center shows for each message when it arrived, what the filters decided and whether it was delivered.
We install the gateway, connect it to your mail server and to LDAP or Active Directory, and change DNS records (MX, SPF and, if wanted, DKIM signing). During the first weeks we adjust scores and rules with you until filtering matches your mail traffic.
Clustering
Several gateways can form a cluster. One node is the master, where you change the configuration; the other nodes pick it up automatically. Synchronisation runs through an SSH tunnel, over which the nodes replicate their PostgreSQL databases (port 5432) asynchronously. If a node fails, the others keep accepting mail, and a returning node rejoins without manual work. Two MX records with equal priority spread the load.
Technical details
- Current release
- Proxmox Mail Gateway 9.1, released 11 June 2026 (as of October 2026)
- Base system
- Debian 13 “Trixie”
- Components
- Postfix, ClamAV, SpamAssassin
- Ports
- 25 inbound, 26 for outbound mail from your internal server, 8006 for the web interface
- Filtering mode
- before queue (reject with 554) or after queue
- Rule system
- Who, What, When and Action objects; direction inbound, outbound or both
- Quarantines
- spam (user self-service with daily report), virus, attachment
- Cluster
- one master plus at least one further node; database sync through an SSH tunnel (administration guide)
- Licence
- GNU AGPLv3; subscription optional, in a cluster one per node at the same level
What is included
- Review of your current mail flow and DNS records
- Installation as a VM or on dedicated hardware
- Connection to your mail server and directory (LDAP, Active Directory)
- Changes to MX, SPF and, on request, DKIM
- Rules for spam, viruses, attachment types and exceptions
- User quarantine and daily spam report
- Optional cluster with two or more nodes
- Tuning during the first weeks, documentation and a handover session
Who it is for
Proxmox Mail Gateway fits organisations that run their own mail server, or that do not want mail routed through a third-party filtering service. It handles a single domain as well as the many domains of an IT service provider.
If you use Microsoft 365 or another cloud mail service, a gateway in front is possible but adds DNS and connector work. We check with you whether it is worth it.
Frequently asked questions
Does a cluster need several subscriptions?
A subscription is optional. If you want vendor support for a cluster, every node needs its own subscription, all at the same level. inett is a Proxmox Gold Partner; you can buy the subscriptions in the inett shop at shop.inett.lu.
Can users manage their own quarantine?
Yes. They receive a daily spam report and can deliver or delete messages, or add senders to their personal welcome list or block list. They log in through a link in the report or with their LDAP account.