Hermes Secure Email Gateway

Hermes Secure Email Gateway is a self-hosted Linux stack that combines email security, mail hosting, encryption, and collaboration. It is best for SMBs, MSPs, self-hosters, and privacy-focused teams willing to run Docker infrastructure; its broad controls come with ongoing administration and no built-in malware sandbox.

Overview

Hermes can sit in front of Microsoft 365, Google Workspace, Exchange, or Postfix, operate as a complete mail server, or use a hybrid arrangement. That makes it a practical security layer for an existing cloud service as well as a consolidation option for organizations prepared to host mail themselves.

Inbound messages pass through Postfix postscreen and RBL checks before Amavisd-new coordinates SpamAssassin and ClamAV scanning. Outbound filtering is included, strengthening policy control in both directions. However, Hermes has no malware sandboxing, so organizations that need detonation or behavioral analysis should choose another gateway or add a separate service.

Key features

Authentication coverage is unusually broad for a self-hosted stack: Hermes checks SPF, signs and verifies DKIM, enforces and aggregates DMARC, and signs and verifies ARC. Administrators can use SMTP TLS, S/MIME, PGP, encrypted PDF fallback, and Dovecot mail-crypt encryption at rest. These options address transport, message-level, and stored-mail protection, but they also create configuration and key-management work for the operator.

Full-server mode includes Dovecot 2.4 mailboxes with IMAPS, POP3S, Submission, and LMTP. Per-domain and per-mailbox quotas, shared mailboxes, and Sieve rules provide the controls expected in a hosted-mail deployment. Bundled Nextcloud adds file synchronization, webmail, calendars, and contacts, with CalDAV and CardDAV support, making Hermes more than a filtering appliance.

Authelia supplies single sign-on and supports TOTP, WebAuthn, and Duo Push MFA. Pro adds time-of-click Link Guard, email disclaimers, organizational signatures, intrusion-prevention and console-firewall interfaces, and LDAP RemoteAuth. Those additions matter to organizations with stricter identity, policy, or perimeter requirements, while smaller installations may find the Community feature set sufficient.

Pricing

Community Edition removes license cost but leaves deployment and support with the operator. Pro uses a flat per-server license that protects thousands of mailboxes, rather than charging per mailbox. It includes a free 30-day trial with no credit card required; direct vendor support otherwise requires eligible Pro support coverage or purchased incidents. The free edition is therefore attractive for technically capable teams, while Pro is easier to justify when advanced controls or formal assistance outweigh the annual server fee.

Platforms

Hermes is Linux-only and self-hosted. The host must run Docker Engine 24.0 or later and Docker Compose v2. Community help is informal through GitHub forums, the issue tracker, Matrix, and Telegram, so teams should budget their own operational expertise unless they purchase qualifying Pro support.

Who it's for

Choose Hermes for an SMB or MSP securing Microsoft 365 or Google Workspace, a self-hoster wanting complete mail hosting, or a privacy-focused organization that values encryption and local control. It is less suitable for teams seeking a managed service, direct support without additional coverage, or malware sandboxing.

Pros and cons

• Pros: One stack covers gateway, full mail server, hybrid deployment, encryption, authentication, MFA, and Nextcloud collaboration.
• Pros: A flat Pro server license can cover thousands of mailboxes, with a no-card 30-day trial.
• Cons: Linux, Docker, and self-hosting impose substantial administration and infrastructure responsibility.
• Cons: No malware sandboxing, and direct vendor support is not included for every deployment.

Alternatives

Xeams is worth considering for a hobby deployment limited to five personal users, with broader platform coverage. Pick Rspamd when you want an open-source Linux filtering engine rather than Hermes's bundled mail and collaboration stack. Scrollout F1 suits users seeking a free gateway with unlimited domains and servers. MailScanner is another free, open-source Linux gateway. Mailprotector fits organizations preferring a web-based commercial service with account-managed pricing. VM Backup is a virtualization backup product, not a direct email-gateway substitute. Spamihilator targets Windows POP3 and IMAP filtering. Mimecast Data Leak Prevention is a web SaaS option focused on cloud exfiltration detection.

Verdict

Hermes is a strong choice for technically capable organizations that want a self-hosted gateway or mail server with deep authentication, encryption, MFA, and collaboration in one stack. Look elsewhere if you need malware sandboxing, a hosted operating model, or dependable direct vendor support without Pro coverage or purchased incidents.