Zero-Inbound-Port Homelab Mail: The Planned SES, S3 Store-and-Forward & Stalwart Setup

Hosting an email server on a residential internet connection has historically been considered an operational death wish.

Between residential ISPsISPInternet Service ProviderNetworkingAn organization that provides residential, enterprise, or carrier network connectivity, IP transit, and routing access to the global Internet. unconditionally blocking inbound TCPTCPTransmission Control ProtocolNetworkingA connection-oriented transport layer protocol providing reliable, ordered, congestion-controlled, and error-checked delivery of byte streams over IP networks. Port 25, dynamic residential IP blocks being permanently flagged on global Spamhaus/CBL blacklists, and homelab reboots bouncing inbound messages back to senders with cryptic 550 Connection Refused errors, running a traditional Postfix/Dovecot stack at home is notoriously fragile.

For HOME-LAB.net, I conceptualized a decoupled split-horizon mail architecture: Serverless Inbound Store-and-Forward via Amazon SES & S3S3Simple Storage ServiceCloudAmazon Web Services scalable object storage offering 99.999999999% (11 9s) of data durability with fine-grained IAM policies and versioning., paired with an Outbound HTTPSHTTPSHypertext Transfer Protocol SecureSecurityAn extension of HTTP that encrypts and authenticates client-server communication over Transport Layer Security (TLS) to prevent eavesdropping and tampering. Pull into Stalwart, Roundcube Webmail, and a Straight Outbound Relay through Amazon SES.

Here is how the planned blueprint works.

---

1. The Core Architecture

---

2. Inbound: Serverless SES → S3 Store-and-Forward

Instead of trying to route raw inbound SMTPSMTPSimple Mail Transfer ProtocolNetworkingThe foundational Internet standard communication protocol for relaying and delivering outbound electronic mail across Mail Transfer Agents (MTAs). directly through a residential firewall, the inbound flow leverages AWSAWSAmazon Web ServicesCloudAmazon global cloud computing platform offering on-demand compute, object storage, content delivery, and managed infrastructure services across dozens of geographic regions. as a resilient, zero-maintenance buffer:

Step 1: Edge MX Termination

The public Route 53Route 53Amazon Route 53CloudAWS highly available, authoritative cloud Domain Name System (DNS) service supporting latency-based routing, health checks, and CloudFront alias records. MX record will point directly to Amazon SES in Tokyo:

home-lab.net.  IN  MX  10 inbound-smtp.ap-northeast-1.amazonaws.com.

When an external sender transmits a message:

• Amazon SES terminates the connection on AWS edge infrastructure over standard port 25 with opportunistic TLSTLSTransport Layer SecuritySecurityCryptographic protocol operating above transport protocols to provide mutual authentication, confidentiality, and data integrity over networks..
• SES automatically evaluates incoming SPFSPFSender Policy FrameworkSecurityAn email authentication standard allowing domain owners to publish DNS records specifying authorized mail transfer agents (MTAs) permitted to send on their behalf. records, checks cryptographic DKIMDKIMDomainKeys Identified MailSecurityAn email authentication standard using asymmetric public-key cryptography to verify sender domain identity and ensure in-transit message tampering prevention. signatures, validates DMARCDMARCDomain-based Message Authentication & ConformanceSecurityA security policy framework leveraging SPF and DKIM validation results to instruct receiving mail servers how to treat fraudulent or spoofed messages. alignment, and runs anti-virus and anti-spam heuristics.

Step 2: The S3 Store-and-Forward Relay

An SES Receipt Rule will capture messages destined for *@home-lab.net:

1. Raw MIME Storage: SES writes the raw, byte-for-byte RFCRFCRequest for CommentsArchitectureThe formal publication series authored by the IETF and Internet Society that documents technical specifications, protocols, and best current practices for the Internet. 5322 .eml payload directly into an encrypted S3 bucket (s3://home-lab-net-mail-relay/inbound/).
2. Encryption at Rest: Objects are encrypted using server-side AES-256AESAdvanced Encryption StandardSecurityThe global symmetric block cipher standard (FIPS 197) utilizing 128-, 192-, or 256-bit keys to encrypt data at rest and in transit across TLS, VPNs, and storage. (aws:kms or AES256).
3. Automated Lifecycle Policy: A 7-day expiration rule ensures obsolete files are purged automatically if unretrieved, keeping storage minimal.

Step 3: Zero-Inbound-Port Pull

This is the architectural linchpin that eliminates port forwarding:

• A local worker process (or Stalwart’s native S3 ingest integration) inside the homelab will poll the S3 bucket using restricted IAMIAMIdentity & Access ManagementSecurityA security framework of role-based and attribute-based policies controlling which identities (users, services, or roles) can perform actions on cloud resources. credentials (s3:GetObject, s3:DeleteObject).
• Because the connection is initiated outbound from the homelab to AWS over HTTPS (TCP 443), zero inbound ports are opened on the residential router.
• Newly retrieved .eml files will be ingested into Stalwart Mail Server, which indexes message headers, full-text bodies, and attachments into its local RocksDB database on ZFSZFSZettabyte File SystemStorageAn enterprise combined file system and logical volume manager featuring copy-on-write, data integrity checksumming, snapshots, and software RAID..
• Once successfully committed to local disk, the worker deletes the object from S3.

---

3. Webmail & Identity: Roundcube + Authelia

Once ingested into Stalwart, messages will be presented through a clean local webmail interface:

• Stalwart Mail Server: A modern, single-binary mail engine written in Rust. It replaces the legacy multi-daemon combination of Postfix, Dovecot, OpenDKIM, and SpamAssassin, delivering blazingly fast JMAP and IMAPIMAPInternet Message Access ProtocolNetworkingAn application-layer email retrieval protocol that synchronizes folders and message state bi-directionally between a mail server and multiple client devices. performance.
• Roundcube Webmail: Planned at https://mail.home-lab.net behind the local Caddy reverse proxy with DNS-01 wildcard TLS certificates.
• Authelia SSOSSOSingle Sign-OnSecurityAn authentication scheme (powered by SAML 2.0 or OIDC) that enables a user to log in once with a central Identity Provider and gain access to multiple independent software systems. (XOAUTH2 / OIDCOIDCOpenID ConnectSecurityAn identity authentication layer built on top of OAuth 2.0 that enables CI/CD pipelines and clients to obtain short-lived cloud credentials without storing static secrets.): Will provide unified single sign-on across the entire homelab so a single WebAuthn hardware passkey or biometric login unlocks webmail, Immich, GitLab, and internal dashboards.
• Mobile Clients: Native mail applications on iOS and macOS will connect directly to Stalwart over IMAP/JMAP whenever connected to home Wi-FiWi-FiIEEE 802.11 Wireless NetworkingNetworkingA family of wireless local area network (WLAN) radio protocols based on the IEEE 802.11 standards operating in the 2.4 GHz, 5 GHz, and 6 GHz spectrum bands. or roaming over the AlwaysRoute (alwaysroute.com) WireGuardWireGuardWireGuard VPN ProtocolSecurityA modern, kernel-resident VPN tunnel protocol using state-of-the-art primitives (ChaCha20-Poly1305, Curve25519) for high-throughput, low-overhead encrypted point-to-point links. on-demand tunnel.

---

4. Outbound: “Straight Outbound” Relay via Amazon SES

Residential IP ranges are hardcoded into global spam blocklists (Spamhaus, SpamCop, Barracuda). Attempting to deliver outbound mail directly from a home connection results in near-instant spam folder placement or outright rejection.

My planned setup resolves this through a straight outbound relay:

1. Client Submission: The user sends an email from Roundcube or a mobile client. The client authenticates against Stalwart over local SMTP submission (Port 587 with STARTTLSSTARTTLSOpportunistic TLS Protocol CommandSecurityAn ESMTP and IMAP protocol extension that upgrades an existing plaintext connection to an encrypted TLS channel on the same port.).
2. Local DKIM Signing: Stalwart cryptographically signs the outbound message using home-lab.net’s 2048-bit private DKIM key (d=home-lab.net, s=mail).
3. Straight Outbound Relay: Stalwart relays the signed message directly to Amazon SES:

   Endpoint: email-smtp.ap-northeast-1.amazonaws.com
   Port:     587 (STARTTLS)
   Auth:     Dedicated IAM SMTP Credentials

4. Global Edge Delivery: Amazon SES accepts the pre-authenticated message and transmits it to destination servers (Google Workspace, Microsoft 365, ProtonMail) from Amazon’s warmed, high-reputation IP pool.

Cryptographic Alignment in Route 53

Deliverability is enforced via strict, declarative DNSDNSDomain Name SystemNetworkingThe distributed hierarchical naming system that translates human-readable hostnames into numerical IP addresses and directs mail routing via MX records. records:

• SPF: v=spf1 include:amazonses.com ~all
• DKIM: 3× Route 53 CNAME records provisioned via Amazon SES Easy DKIM (*._domainkey.home-lab.net).
• DMARC: Strict enforcement policy rejecting unaligned spoofed mail without noisy aggregate report spam:

  _dmarc.home-lab.net.  IN  TXT  "v=DMARC1; p=reject; pct=100"

---

5. Architectural Comparison

Dimension	Traditional Self-Hosted Mail	HOME-LAB.net Planned Architecture
Inbound Port 25	Required on home router (blocked by most ISPs)	Blocked & Closed (Outbound HTTPS pull via S3)
Outbound Port 25	Blocked by ISP / Blacklisted on Spamhaus	Not used (Straight Port 587 TLS relay via Amazon SES)
Reboot Resilience	Offline server causes 550 Connection Refused	Zero-bounce (S3 acts as an elastic, durable buffer)
Deliverability	Poor (residential IP reputation issues)	100% Inbox Placement (Valid SPF, DKIM, DMARC on SES IPs)

---

6. Build To-Do Checklist

Here is the concrete implementation roadmap I’ll be working through to bring this stack online on the ProxmoxProxmoxProxmox Virtual EnvironmentVirtualizationAn open-source Debian-based enterprise virtualization platform tightly coupling KVM hypervisors, LXC containers, ZFS storage, and clustered management. VE host:

• Phase 1 — AWS SES & S3 Relay (TerraformTerraformHashiCorp TerraformDevOpsAn open-source Infrastructure as Code (IaC) tool that provisions, manages, and versions multi-cloud resources declaratively via HashiCorp Configuration Language.): Provision the ap-northeast-1 SES domain identity, Easy DKIM CNAME records, encrypted home-lab-net-mail-relay S3 bucket (7-day lifecycle), and SES Inbound Receipt Rule.
• Phase 2 — Outbound SES Production Access: Request SES sandbox exit in Tokyo and generate least-privilege IAM credentials for both the S3 inbound puller (s3:GetObject, s3:DeleteObject) and Port 587 SMTP outbound relay.
• Phase 3 — Stalwart LXCLXCLinux ContainersVirtualizationOS-level virtualization technology providing lightweight, near-bare-metal isolated Linux user spaces using kernel cgroups and namespaces. on Host ZFS: Provision a dedicated unprivileged Debian LXC container on Proxmox VE with a bind-mounted NVMeNVMeNon-Volatile Memory ExpressStorageAn open logical-device interface specification engineered specifically for solid-state storage over PCIe buses, maximizing parallel I/O queues. ZFS dataset (rpool/data/stalwart) and configure RocksDB storage + S3 inbound polling.
• Phase 4 — Roundcube + Authelia OIDC (XOAUTH2): Deploy Roundcube behind Caddy (https://mail.home-lab.net) and wire OIDC token authentication so Authelia passkey sessions log straight into webmail without a second password prompt.
• Phase 5 — Fault-Injection & Reboot Testing: Shut down the Stalwart LXC container, send external test emails from Gmail/ProtonMail, verify they queue cleanly in S3 with zero bounces, and confirm automatic ingestion upon container boot.

---

7. What’s Next

This architecture bridges the best of both worlds: complete local storage on the Proxmox host’s native ZFS on the inside, with enterprise-grade reliability and zero open firewall ports on the outside.

This project is queued up right after I finish upgrading the UniFi core network and the lab server itself. Once the hardware and core network foundation are in place, I’ll work through the checklist above and share the Terraform modules, IAM least-privilege policies, and Stalwart configuration notes in upcoming logs.