Hermes Secure Email Gateway vs Rspamd
Hermes Secure Email Gateway
hermesseg.ioRspamd
rspamd.comSide by side
| Figure | Hermes Secure Email Gateway | Rspamd |
|---|---|---|
| Price from | $62.50/mo | £100/mo |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | Yes | Yes |
| Web | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 5 |
| Spec score · Email Security Gateways | 9.0 (#1) | 8.9 (#2) |
| Deployment | It can run as a gateway in front of Microsoft 365, Google Workspace, Exchange, or Postfix, as a full mail server, or in hybrid mode. | The project describes the engine as runnable on-premises, with message data staying in the user's environment and no mandatory vendor cloud dependency. |
| Documentation depth | Online documentation is organized into installation/reference material, a 60-page administrator guide and an 11-page user guide. | Documentation includes installation, configuration, modules, workers, tutorials, developer architecture and protocol material, a Lua API reference and FAQ. |
| Email authentication | The stack checks SPF, signs and verifies DKIM, enforces and aggregates DMARC, and signs and verifies ARC. | Rspamd validates SPF, DKIM, DMARC and ARC, including cryptographic signing capabilities. |
| Filtering | Inbound mail passes through Postfix postscreen and RBL checks, then Amavisd-new orchestrates SpamAssassin and ClamAV scanning. | It combines reputation, sender authentication, content analysis, and machine learning to score and filter messages. |
| Malware scanning | ClamAV and Amavisd-new scan messages, with Fangfrisch-managed third-party signature feeds. | Rspamd can integrate with ClamAV and commercial antivirus engines to detect malware and dangerous attachment types. |
| Self-hosting | The complete source, installer scripts and Docker deployment files are publicly downloadable from GitHub. | Rspamd is designed to run on the operator's infrastructure and can be deployed with packages, Docker or Kubernetes-oriented setups. |
| Support channels | Support is offered through GitHub Discussions, Matrix, Telegram, GitHub Issues and paid helpdesk tickets for Pro license holders. | Community help is offered through GitHub, Discord, Telegram and mailing lists, while commercial support is available for large or custom deployments. |
| What it does | Hermes is a self-hosted Docker Compose email-security gateway and full mail server that can also run in hybrid mode. | Rspamd is a high-performance daemon that analyzes email beside a mail-transfer agent and returns a spam score and recommended action. |
Plans
Hermes Secure Email Gateway
- Community EditionFree
- Community EditionFree
- Pro Edition$750 a year
Rspamd
- Open-source RspamdFree
- Scale£100 a month
- Scale£100 a month
- EnterprisePriced on request
- HostedPriced on request
In their own words
Hermes Secure Email Gateway
Hermes Secure Email Gateway is a self-hosted Docker Compose stack for email security, mail hosting, encryption, and collaboration. It can sit in front of Microsoft 365, Google Workspace, Exchange, or Postfix, run as a full mail server, or combine those roles in a hybrid setup. Incoming mail passes through Postfix postscreen and RBL checks, followed by scanning orchestrated by Amavisd-new with SpamAssassin and ClamAV. Hermes checks SPF, signs and verifies DKIM, enforces and aggregates DMARC, and signs and verifies ARC. Encryption options include SMTP TLS, S/MIME, PGP, encrypted PDF fallback, and Dovecot mail-crypt at rest. Full-server mode adds Dovecot mailboxes, IMAPS, POP3S, Submission, LMTP, quotas, shared mailboxes, and Sieve rules. Bundled Nextcloud supplies file sync, webmail, calendars, and contacts; Authelia provides single sign-on and multi-factor options. The free Community Edition is open source. Pro costs $750.00 per year per server and has a free 30-day trial. Hermes requires a Linux host with Docker Engine 24.0 or later and Docker Compose v2.
Rspamd
Rspamd is an email security engine for filtering phishing, business email compromise, malicious attachments, and spam. It scores messages using reputation, sender authentication, content analysis, and machine learning. Authentication checks cover SPF, DKIM, DMARC, and ARC; malware scanning can use ClamAV or commercial antivirus engines. Administrators can define custom rules through the Lua API and configurable maps and selectors. Rspamd works with mail transfer agents including Postfix, Exim, and Sendmail, and its ClickHouse and Elasticsearch integrations provide visibility into attack patterns and detection rates. It is designed for gateway deployment and can run on-premises, keeping message data in the operator's environment without a mandatory vendor cloud. The detection engine is open source under Apache 2.0 and is available for Linux, macOS, and self-hosted use. Rspamd says its event-driven C core scans hundreds of messages per second per core and can scale from a single server to billions of messages a day. The open-source engine is listed at free. Scale costs £100 a month, with 5K mailboxes; hosted and enterprise plans have custom pricing. Premium plans offer support from core engineers, with enterprise SLA options.