webmailMaquita: AGPL webmail suite brings eDiscovery and DLP to Postfix and Dovecot

An open-source answer to enterprise email compliance

A developer has released webmailMaquita, a webmail and collaboration suite published under the AGPL-3.0 license and aimed squarely at a gap in self-hosted email: compliance tooling. According to the announcement post on dev.to, the project is built for mail servers running Postfix and Dovecot, and it packages eDiscovery, legal hold and data loss prevention into a stack that operators control themselves, without per-seat commercial licenses or a move to a cloud suite.

The motivation, as described by the developer, came from real production deployments: Roundcube, the go-to open-source client for this infrastructure, did not meet their auditing and interface needs, while the advanced DLP and compliance features they required are normally found only in expensive enterprise products. Rather than pay for those capabilities, they built an open-source layer on top of their existing infrastructure.

What the suite includes

The application pairs a React front end with a FastAPI back end. Core mail features include conversation threading, labels, Sieve rule support and full-text search. On the collaboration side, it offers calendar and contacts through CalDAV and CardDAV, Kanban-style task boards and chat. Account security covers two-factor authentication using TOTP, and messages can be encrypted at rest via Dovecot's mail_crypt plugin.

The mail security layer handles SPF, DKIM, DMARC and integration with Rspamd. It also includes anti-spoofing checks that flag lookalike domains, homoglyphs and attempts to impersonate internal roles — a common vector for business email compromise. Outbound DLP scans for sensitive patterns such as national ID numbers, tax identifiers, IBANs and payment card data, and because it operates as a milter, the same protections apply to users sending through Outlook or mobile clients, not just the webmail interface.

There is also what the developer calls active defense: automated detection and containment of compromised accounts that start emitting large volumes of outbound mail.

eDiscovery and audit trail

The compliance tooling is the distinguishing part of the project. Administrators can run forensic searches across every mailbox, place messages under legal hold and manage custodians. Exports produced for legal purposes are signed with GPG and carry RFC 3161 timestamps to support integrity and verifiability.

For traceability, the system logs 39 distinct event types and correlates them across the whole delivery chain, from Postfix through Rspamd and Dovecot down to individual user actions, giving auditors a single connected record rather than fragments from separate logs.

Beyond mail, the repository bundles shared drives, OnlyOffice integration and an optional AI module that runs entirely locally on Ollama and Whisper for dictation and writing suggestions, with no data sent to external APIs. Deployment is native to Debian via a reproducible installation script.

Stated limitations

The developer is explicit about what is unfinished. Retention policies can be defined in the interface, but the automated purge and archive process behind them is still being built. Quarantine is currently handled manually by administrators. On scale, the suite has been tested in a real production environment with roughly 300 mailboxes and more than 100,000 messages, but it has not been validated for deployments with thousands of concurrent users.

The code is on GitHub, and the team is asking for testing on clean Debian installations, security reviews, bug reports and feedback on both architecture and roadmap.

Why it matters

eDiscovery, legal hold and DLP have effectively been proprietary territory. Organizations in regulated sectors that wanted to keep email self-hosted had to choose between buying enterprise licensing per user or migrating to a hosted suite, which is exactly the trade-off this project tries to eliminate. The AGPL license adds a further safeguard for the commons: anyone offering it as a network service must publish their modifications.

The caveats are real, though. All claims about the project come from its own announcement, the largest validated deployment is modest, the security posture has not yet been independently reviewed, and retention automation is incomplete — a significant point for anyone with hard legal retention obligations. Even so, for a long-underserved niche of sysadmins running Postfix and Dovecot under compliance requirements, this is one of the few credible open-source attempts at the problem, and its roadmap will be worth watching.