Skip to content
SPECIFICTION
Get listed

Hermes Secure Email Gateway

hermesseg.io

From $62.50/mo Free plan Open source WebLinuxSelf-hosted
Visit hermesseg.io
Spec score 9.0 #1 of 35 in Email Security Gateways

What it is

Hermes Secure Email Gateway is a self-hosted Docker Compose stack for email security, mail hosting, encryption, and collaboration. It can sit in front of Microsoft 365, Google Workspace, Exchange, or Postfix, run as a full mail server, or combine those roles in a hybrid setup. Incoming mail passes through Postfix postscreen and RBL checks, followed by scanning orchestrated by Amavisd-new with SpamAssassin and ClamAV. Hermes checks SPF, signs and verifies DKIM, enforces and aggregates DMARC, and signs and verifies ARC. Encryption options include SMTP TLS, S/MIME, PGP, encrypted PDF fallback, and Dovecot mail-crypt at rest. Full-server mode adds Dovecot mailboxes, IMAPS, POP3S, Submission, LMTP, quotas, shared mailboxes, and Sieve rules. Bundled Nextcloud supplies file sync, webmail, calendars, and contacts; Authelia provides single sign-on and multi-factor options. The free Community Edition is open source. Pro costs $750.00 per year per server and has a free 30-day trial. Hermes requires a Linux host with Docker Engine 24.0 or later and Docker Compose v2.

Spec sheet

What it does
Hermes is a self-hosted Docker Compose email-security gateway and full mail server that can also run in hybrid mode.Read 15 Oct 2026 · hermesseg.io
Product
Hermes is a self-hosted Docker Compose stack combining email security, mail hosting, end-to-end encryption, and Nextcloud collaboration.Read 7 Oct 2026 · hermesseg.io
Audience
The site presents Hermes for SMBs, MSPs, self-hosters, privacy-focused teams, and organizations adding a gateway in front of Microsoft 365 or Google Workspace.Read 7 Oct 2026 · hermesseg.io
Deployment
It can run as a gateway in front of Microsoft 365, Google Workspace, Exchange, or Postfix, as a full mail server, or in hybrid mode.Read 7 Oct 2026 · hermesseg.io
Integrations
Published integration targets include Microsoft 365, Google Workspace, Exchange, Postfix, Nextcloud, LDAP and Active Directory.Read 15 Oct 2026 · hermesseg.io
Support
Community support is informal through GitHub forums, the issue tracker, Matrix, and Telegram; direct vendor support requires eligible Pro support coverage or purchased incidents.Read 7 Oct 2026 · hermesseg.io
Collaboration integrations
The stack bundles Nextcloud for file sync, webmail, calendars, and contacts, with CalDAV and CardDAV support.Read 7 Oct 2026 · hermesseg.io
Deployment modes
It supports gateway deployment ahead of Microsoft 365, Google Workspace, Exchange or Postfix, full mail-server deployment, and mixed gateway/mail-server deployments.Read 15 Oct 2026 · github.com
Documentation depth
Online documentation is organized into installation/reference material, a 60-page administrator guide and an 11-page user guide.Read 15 Oct 2026 · github.com
Email authentication
The stack checks SPF, signs and verifies DKIM, enforces and aggregates DMARC, and signs and verifies ARC.Read 15 Oct 2026 · hermesseg.io
Encryption
Hermes supports SMTP TLS, S/MIME, PGP, encrypted-PDF fallback and Dovecot mail-crypt encryption at rest.Read 15 Oct 2026 · hermesseg.io
Filtering
Inbound mail passes through Postfix postscreen and RBL checks, then Amavisd-new orchestrates SpamAssassin and ClamAV scanning.Read 7 Oct 2026 · hermesseg.io
Groupware
Nextcloud supplies file synchronization, webmail, calendars and contacts through CalDAV and CardDAV.Read 15 Oct 2026 · hermesseg.io
Identity and MFA
OpenLDAP and Authelia provide directory services, SSO and MFA options including TOTP, WebAuthn and Duo Push.Read 15 Oct 2026 · github.com
Installation time
The installer documentation estimates 10 to 30 minutes on a fresh host, mainly for image downloads and container builds.Read 15 Oct 2026 · github.com
Licence
The Community Edition is licensed under GNU AGPLv3; proprietary Pro files are governed by a commercial EULA.Read 15 Oct 2026 · github.com
Limit: CipherMail credentials
A reported issue says the CipherMail console used a separate stock admin/admin credential that Hermes did not automatically rotate.Read 15 Oct 2026 · github.com
Limit: disk monitoring
An open issue reports no alert when disk space fills, with mail deferral appearing as the first symptom.Read 15 Oct 2026 · github.com
Limit: documentation usability
An open issue says the administrator documentation reads like reference material for builders instead of step-by-step instructions for users.Read 15 Oct 2026 · github.com
Limit: operational burden
The product requires customers to operate Linux, Docker, firewall rules, DNS, storage and mail infrastructure themselves.Read 15 Oct 2026 · hermesseg.io
Limit: scheduled-task control
An open issue reports that scheduled-task schedules are displayed but cannot be changed in the interface.Read 15 Oct 2026 · github.com
Limit: upgrade storage defect
An open issue reports that upgrades may fail when new storage volumes are introduced because directories are not provisioned.Read 15 Oct 2026 · github.com
Link protection
The Pro edition rewrites inbound links and checks destination reputation when users click them.Read 15 Oct 2026 · hermesseg.io
Mail hosting
Full-server mode provides Dovecot 2.4 IMAPS, POP3S, Submission and LMTP mailboxes with quotas, aliases, shared mailboxes and Sieve rules.Read 15 Oct 2026 · hermesseg.io
Maker headquarters
Black Fish Networks, LLC lists 5900 Balcones Drive STE 100, Austin, Texas, United States.Read 15 Oct 2026 · deeztek.com
Maker legal entity
Deeztek is operated by Black Fish Networks, LLC.Read 15 Oct 2026 · deeztek.com
Malware scanning
ClamAV and Amavisd-new scan messages, with Fangfrisch-managed third-party signature feeds.Read 15 Oct 2026 · hermesseg.io
Network requirements
Required inbound ports are TCP 25, 80 and 443, with additional mailbox ports 465, 587, 993 and 995 for mail-server or hybrid deployments.Read 15 Oct 2026 · hermesseg.io
Platform requirements
Hermes requires a Linux host capable of running Docker Engine 24.0 or later and Docker Compose v2.Read 7 Oct 2026 · hermesseg.io
Pro features
Pro adds time-of-click Link Guard, email disclaimers, organizational signatures, intrusion-prevention and console-firewall interfaces, and LDAP RemoteAuth.Read 7 Oct 2026 · hermesseg.io
Production recommendation
The vendor recommends 16 GB or more RAM for production workloads with substantial mail or Nextcloud use.Read 15 Oct 2026 · hermesseg.io
Project history
The repository dates to 21 December 2017, while the Docker Edition codebase began its public history in June 2026.Read 15 Oct 2026 · github.com
Repository activity
The public repository shows 142 stars, 26 forks and 44 open issues at the time captured.Read 15 Oct 2026 · github.com
Security disclosure
Vulnerabilities are requested through GitHub private reporting or a security email rather than public issue reports.Read 15 Oct 2026 · github.com
Security policy
Only the latest published calendar-versioned release receives security fixes; older releases are unsupported.Read 15 Oct 2026 · github.com
Self-hosting
The complete source, installer scripts and Docker deployment files are publicly downloadable from GitHub.Read 15 Oct 2026 · hermesseg.io
Spam filtering
Inbound mail is checked with Postfix postscreen, reputation block lists, configurable allow/block lists and Apache SpamAssassin.Read 15 Oct 2026 · hermesseg.io
Support channels
Support is offered through GitHub Discussions, Matrix, Telegram, GitHub Issues and paid helpdesk tickets for Pro license holders.Read 15 Oct 2026 · github.com
System requirements
The Docker edition requires Linux capable of running Docker Engine 24.0+ and Compose v2, with at least 4 vCPUs, 8 GB RAM and 275 GB storage.Read 15 Oct 2026 · hermesseg.io
Update process
A single update orchestrator performs Git pulls, image refreshes, schema migrations, service restarts and post-upgrade hooks.Read 15 Oct 2026 · github.com

Plans and prices

Community Edition Free Free and open-source; self-hosted Docker Compose stack Read 7 Oct 2026 · hermesseg.io
Community Edition Free free and open source full gateway and mail-server stack · core security and encryption · mailbox hosting · administration Read 15 Oct 2026 · github.com
Pro Edition $750 a year per server, monthly or annually Link Guard · disclaimers · organizational signatures · intrusion-prevention UI · console-firewall UI · LDAP RemoteAuth Read 15 Oct 2026 · hermesseg.io

Every Hermes Secure Email Gateway plan and price →

Strong points and limits

Strong points

  • Supports gateway, full-server, and hybrid deployment.
  • Includes multiple email authentication checks.
  • Offers SMTP TLS, S/MIME, PGP, and encrypted PDF fallback.
  • Bundles Nextcloud and Authelia.
  • Free, open-source Community Edition.

Limits

  • Requires Linux, Docker Engine 24.0 or later, and Compose v2.
  • Pro costs $750.00 per year per server.
  • Community support is informal.
  • Direct vendor support requires eligible coverage or purchased incidents.

Who it suits

Hermes suits SMBs, MSPs, self-hosters, and privacy-focused teams looking for a self-hosted mail security stack. It also fits organizations adding a gateway in front of Microsoft 365 or Google Workspace, provided they can meet the Linux and Docker requirements.

Verdict

Hermes combines a broad set of mail security and hosting functions with collaboration and identity services in a self-hosted stack. Its deployment flexibility comes with Linux and Docker requirements; Pro adds features at a per-server annual price.

Where Specifiction places it

Alternatives to Hermes Secure Email GatewayAll alternatives →