SecureMilter: SPF, DKIM, DMARC & ARC for Postfix
An open source milter suite implementing RFC 7208, RFC 6376, RFC 7489, and RFC 8617 — free to run, free to modify, no license fees, no paid tier. Built by SecureMessage and given back to the mail admin community.
Independent Milters You Compose Yourself
Each daemon does one job well and speaks the Sendmail milter protocol directly to Postfix. Run all four, or only the ones you need.
SecureSPF
Verifies the Sender Policy Framework record for the connecting IP (RFC 7208), with full mechanism and macro support.
SecureDKIM
Signs outbound and verifies inbound mail (RFC 6376), with RSA-SHA256 and Ed25519-SHA256 (RFC 8463) support.
SecureDMARC
Evaluates policy alignment against upstream SPF/DKIM results (RFC 7489), with a native DNS tree walk for organizational domains.
SecureARC
Validates and seals the Authenticated Received Chain (RFC 8617), preserving authentication results across forwarding hops.
Why This Suite
Thread-Per-Core, kqueue-Native
Written in Zig for FreeBSD. Each worker owns its own kqueue event loop and DNS cache — no locks on the hot path, no timers, no polling.
Security Audited
Every daemon has been through a full code review and a live penetration test against real inbound and outbound mail, with findings tracked to closure.
RFC-Conformance Tested
Each protocol is checked against a dedicated conformance suite covering the standard's edge cases, not just the common path.
BSD-2-Clause Licensed, No Lock-In
Man pages, command-line conformance tools, and a full deployment guide — free, permissively licensed, and yours to fork. Runs on your own Postfix, on your own hardware.
Free to Download, Free to Run
Installation, configuration, key generation, and Postfix integration are all covered in the SecureMilter documentation — no account, no signup, no license key required.
BSD 2-Clause License — free to use, modify, and redistribute, commercially or otherwise.