Mailoney

Free plan LinuxSelf-hostedWindows

What Mailoney is

Mailoney is a self-hosted, low-interaction SMTP honeypot for detecting and logging unauthorized access attempts, credential harvesting, and other SMTP attacks. It simulates a vulnerable mail server, accepts connections on port 25, and captures authentication attempts and credentials. Session data can be stored in SQLite, PostgreSQL, or MySQL/MariaDB; PostgreSQL is recommended for production. The database can also be disabled for event-logging-only operation. Mailoney emits JSON Lines events for log shippers, and its project describes forwarding data to SIEM, ELK Stack, or Loki. An optional Prometheus endpoint reports connection, session, credential, command, and duration metrics. Captured email bodies are discarded by default; setting `MAILONEY_MAIL_DIR` opts in to saving them to disk. STARTTLS is supported when both a certificate and matching private key are configured, with TLS 1.2 as the minimum handshake version. Deployment options include a Docker image with Docker Compose instructions or local installation using Python. Mailoney supports Linux and Windows and is distributed under the MIT License, which permits use, copying, modification, and distribution without charge. The project recommends a controlled environment, limited privileges, and firewall configuration. Its unauthenticated metrics endpoint can identify the software as a honeypot, so the project recommends keeping that endpoint off the internet.

Who it suits

Mailoney suits security teams and operators who want a self-hosted SMTP decoy to record connection and credential attempts. It can also suit teams forwarding JSON Lines events to logging or security tools.

What it does well

Captures SMTP authentication attempts on port 25.
Supports SQLite, PostgreSQL, and MySQL/MariaDB storage.
Can emit JSON Lines events for log shippers.
Optional Prometheus endpoint reports session and connection metrics.
Docker and Python installation routes are available.
MIT License permits free use and modification.

What to know first

Self-hosted deployment requires an environment to operate it.
Captured email bodies are discarded by default.
The metrics endpoint has no authentication.
STARTTLS requires a certificate and matching private key.

Getting started

Choose Linux or Windows for a self-hosted deployment.
Deploy using the Docker image and Docker Compose instructions, or follow the local Python installation instructions.
Configure SMTP access on port 25 for the simulated server.
Choose SQLite, PostgreSQL, or MySQL/MariaDB for session data, or disable the database for event-only logging.
Configure a certificate and matching private key if enabling STARTTLS.
Keep deployment controlled, use limited privileges, and configure a firewall.

Verdict

Choose Mailoney if you need a self-hosted SMTP honeypot with credential capture and flexible event or database storage. Look elsewhere if you need a built-in REST API; the project only suggests extending Mailoney to provide one.

Questions

How much does Mailoney cost?

Mailoney is free and open source under the MIT License.

Where can I run Mailoney?

It supports Linux and Windows and is deployed as a self-hosted service.

What deployment options are available?

The project provides a Docker image and Docker Compose instructions, plus local installation instructions using Python.

What databases can store session data?

Mailoney supports SQLite, PostgreSQL, and MySQL/MariaDB. PostgreSQL is recommended for production, and the database can be disabled for event-logging-only operation.

Does it provide an API?

The project suggests extending Mailoney to provide a REST API; it does not describe a built-in API.

Does Mailoney save captured email bodies?

Bodies are discarded by default. Setting `MAILONEY_MAIL_DIR` opts in to writing them to disk.

Facts from Mailoney's own pages

API: The README suggests extending Mailoney to provide a REST API; it does not describe a built-in API. · github.com, 4 Oct 2026
Database: Session data can be stored in SQLite, PostgreSQL, or MySQL/MariaDB; PostgreSQL is recommended for production. · github.com, 4 Oct 2026
Deployment: The project documents Docker and Docker Compose deployment, plus local installation from the Python package source. · github.com, 7 Oct 2026
Latest release: The releases page lists version 2.1.0 and says it added destination IP and port logging for SMTP sessions. · github.com, 7 Oct 2026
License: The repository identifies Mailoney as MIT-licensed. · github.com, 7 Oct 2026
Log forwarding: Mailoney can emit JSON Lines events for log shippers and describes forwarding or connecting collected data to SIEM and other security tools. · github.com, 7 Oct 2026
Log integrations: JSON Lines event output can be used with log shippers, and the README describes shipping logs to SIEM, ELK Stack, or Loki. · github.com, 4 Oct 2026
Maker: The GitHub profile identifies the maintainer as Brandon E. and describes his focus as cloud and container security. · github.com, 7 Oct 2026
Message retention: Captured message bodies are discarded by default; setting MAILONEY_MAIL_DIR opts in to saving them as .eml files. · github.com, 7 Oct 2026
Metrics exposure: The unauthenticated metrics endpoint binds to loopback by default, and the project warns that exposing it can reveal the software name and version. · github.com, 7 Oct 2026
Prometheus: An optional Prometheus /metrics endpoint exposes SMTP connection, session, credential, command, and duration metrics. · github.com, 7 Oct 2026
Purpose: Mailoney is a low-interaction SMTP honeypot that simulates a vulnerable mail server to detect and log unauthorized access attempts, credential harvesting, and other SMTP-based attacks. · github.com, 7 Oct 2026
Security guidance: The project advises deploying the honeypot in a controlled environment, limiting privileges, and configuring a firewall to prevent misuse. · github.com, 7 Oct 2026
SMTP capture: It accepts SMTP connections on port 25 and captures authentication attempts and credentials. · github.com, 4 Oct 2026
SMTP listener: It simulates an SMTP server accepting connections on port 25 and captures authentication attempts and credentials. · github.com, 7 Oct 2026
STARTTLS: Mailoney supports SMTP STARTTLS when a certificate and matching private key are configured, with TLS 1.2 as the minimum handshake version. · github.com, 7 Oct 2026
Storage: Session data can be stored in SQLite, PostgreSQL, or MySQL/MariaDB, and the database can be disabled for event-logging-only operation. · github.com, 7 Oct 2026
TLS: The SMTP server supports STARTTLS when both a certificate and private key are configured, with a TLS 1.2 minimum. · github.com, 4 Oct 2026

Where Mailoney stands on Freedom251

Honeypot Software#13 of 21