Hermes Secure Email Gateway
Hermes Secure Email Gateway is a self-hosted Docker Compose stack for email security, mail hosting, encryption, and collaboration.
What Hermes Secure Email Gateway is
Hermes Secure Email Gateway is a self-hosted Docker Compose stack for email security, mail hosting, encryption, and collaboration. It can sit in front of Microsoft 365, Google Workspace, Exchange, or Postfix, operate as a full mail server, or run in hybrid mode. Inbound filtering uses Postfix postscreen and RBL checks, followed by Amavisd-new coordination of SpamAssassin and ClamAV scanning. Hermes checks SPF, signs and verifies DKIM, enforces and aggregates DMARC, and signs and verifies ARC. Encryption options include SMTP TLS, S/MIME, PGP, encrypted PDF fallback, and Dovecot mail-crypt encryption at rest. Full-server mode provides mailboxes, secure IMAP and POP access, Submission, LMTP, quotas, shared mailboxes, and Sieve rules. Nextcloud adds file sync, webmail, calendars, and contacts, while Authelia supplies single sign-on and MFA options including TOTP, WebAuthn, and Duo Push. The free Community Edition is open source; Pro costs $750 a year, billed per server, and has a free 30-day trial with no credit card required. Hermes requires Linux, Docker Engine 24.0 or later, and Docker Compose v2.
Good
- Can run as a gateway, full mail server, or hybrid.
- Combines email authentication checks with spam and malware scanning.
- Supports S/MIME, PGP, and encryption at rest.
- Bundled Nextcloud includes file sync and webmail.
- Free, open-source Community Edition is available.
Watch out
- Requires Linux with Docker Engine 24.0 or later.
- Direct vendor support requires eligible Pro coverage or purchased incidents.
- Malware sandboxing is not available.
- Pro costs $750 a year, billed per server.
Who it suits
Hermes is aimed at SMBs, MSPs, self-hosters, privacy-focused teams, and organizations adding a gateway before Microsoft 365 or Google Workspace. It requires a Linux host capable of running its specified Docker components.
Verdict
Hermes brings mail filtering, hosting, encryption, and collaboration into a self-hosted stack with several deployment modes. It may suit organizations prepared to operate it on Linux; direct vendor support requires eligible paid coverage or purchased incidents.
Plans and prices
From Hermes Secure Email Gateway's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Community Edition | Free | full gateway and mail-server stack · core security and encryption · mailbox hosting · administration · free and open source |
| Pro Edition | $750 | Link Guard · disclaimers · organizational signatures · intrusion-prevention UI · console-firewall UI · LDAP RemoteAuth · per server, monthly or annually |
The facts
Each one read from Hermes Secure Email Gateway's own pages, with the date it was checked.
What it does
- Audience
- The site presents Hermes for SMBs, MSPs, self-hosters, privacy-focused teams, and organizations adding a gateway in front of Microsoft 365 or Google Workspace.checked 7 Oct 2026
- Collaboration integrations
- The stack bundles Nextcloud for file sync, webmail, calendars, and contacts, with CalDAV and CardDAV support.checked 7 Oct 2026
- Deployment
- It can run as a gateway in front of Microsoft 365, Google Workspace, Exchange, or Postfix, as a full mail server, or in hybrid mode.checked 7 Oct 2026
- Deployment modes
- It supports gateway deployment ahead of Microsoft 365, Google Workspace, Exchange or Postfix, full mail-server deployment, and mixed gateway/mail-server deployments.checked 15 Oct 2026
- Documentation depth
- Online documentation is organized into installation/reference material, a 60-page administrator guide and an 11-page user guide.checked 15 Oct 2026
- Email authentication
- The stack checks SPF, signs and verifies DKIM, enforces and aggregates DMARC, and signs and verifies ARC.checked 15 Oct 2026
- Encryption
- Hermes supports SMTP TLS, S/MIME, PGP, encrypted-PDF fallback and Dovecot mail-crypt encryption at rest.checked 15 Oct 2026
- Filtering
- Inbound mail passes through Postfix postscreen and RBL checks, then Amavisd-new orchestrates SpamAssassin and ClamAV scanning.checked 7 Oct 2026
- Groupware
- Nextcloud supplies file synchronization, webmail, calendars and contacts through CalDAV and CardDAV.checked 15 Oct 2026
- Identity and MFA
- OpenLDAP and Authelia provide directory services, SSO and MFA options including TOTP, WebAuthn and Duo Push.checked 15 Oct 2026
- Installation time
- The installer documentation estimates 10 to 30 minutes on a fresh host, mainly for image downloads and container builds.checked 15 Oct 2026
- Integrations
- Published integration targets include Microsoft 365, Google Workspace, Exchange, Postfix, Nextcloud, LDAP and Active Directory.checked 15 Oct 2026
- Licence
- The Community Edition is licensed under GNU AGPLv3; proprietary Pro files are governed by a commercial EULA.checked 15 Oct 2026
- Limit: CipherMail credentials
- A reported issue says the CipherMail console used a separate stock admin/admin credential that Hermes did not automatically rotate.checked 15 Oct 2026
- Limit: disk monitoring
- An open issue reports no alert when disk space fills, with mail deferral appearing as the first symptom.checked 15 Oct 2026
- Limit: documentation usability
- An open issue says the administrator documentation reads like reference material for builders instead of step-by-step instructions for users.checked 15 Oct 2026
- Limit: operational burden
- The product requires customers to operate Linux, Docker, firewall rules, DNS, storage and mail infrastructure themselves.checked 15 Oct 2026
- Limit: scheduled-task control
- An open issue reports that scheduled-task schedules are displayed but cannot be changed in the interface.checked 15 Oct 2026
- Limit: upgrade storage defect
- An open issue reports that upgrades may fail when new storage volumes are introduced because directories are not provisioned.checked 15 Oct 2026
- Link protection
- The Pro edition rewrites inbound links and checks destination reputation when users click them.checked 15 Oct 2026
- Mail hosting
- Full-server mode provides Dovecot 2.4 IMAPS, POP3S, Submission and LMTP mailboxes with quotas, aliases, shared mailboxes and Sieve rules.checked 15 Oct 2026
- Malware scanning
- ClamAV and Amavisd-new scan messages, with Fangfrisch-managed third-party signature feeds.checked 15 Oct 2026
The company
- Maker headquarters
- Black Fish Networks, LLC lists 5900 Balcones Drive STE 100, Austin, Texas, United States.checked 15 Oct 2026
- Maker legal entity
- Deeztek is operated by Black Fish Networks, LLC.checked 15 Oct 2026
Alternatives to Hermes Secure Email Gateway
- 1
Rspamd
Free planOpen sourceWebAPILinuxmacOS8.2From £100 a month - 2
Xeams
Free planWebAPILinuxmacOS7.8From $1.67 a month - 3
Mailprotector
Free planWebAPI7.0Free plan - 4
Symantec IT Management Suite
WebAPILinuxmacOS6.8 - 56.5From $5 a month
- 6
Cisco Catalyst Center
WebAPILinuxmacOS6.2