Open Source · MIT License

Professional Webmail.
Any Server.

A modern, secure, self-hosted webmail client that connects to any IMAP/SMTP server. Own your data. Run it anywhere. No lock-in.

Works with Gmail Outlook Yahoo iCloud Fastmail cPanel Dovecot Any IMAP
SC
Sarah Chen
Re: Q2 Design Review — 2m ago
Server auto-detected
Gmail IMAP · SSL
🔒
23 security fixes
Hardened
N ✏ Compose Inbox 12 Sent Drafts Spam Trash Archive Contacts Calendar Notes Settings Storage — 2.4 GB of 10 GB All Unread Starred Page 1 of 4 ↩ Reply ⤷ Forward ⋯ More 🗑 JD 📎 document.pdf Write a quick reply… Send

Own Your Infrastructure

No SaaS subscriptions. No data harvesting. Your emails live on your server, under your control. Works with any hosting provider or home server.

Zero Trust, Maximum Security

23 security fixes baked in. Encrypted sessions, rate limiting, DOMPurify, CSRF protection, and TLS enforcement — not bolt-ons, but fundamentals.

Modern Stack, Zero Bloat

Built on Next.js 14. No PHP, no plugin system, no legacy baggage. Just npm install, generate a secret, and you're live in under 5 minutes.

Any IMAP/SMTP server
Gmail · Outlook · Dovecot · Postfix
5
Built-in apps
Mail · Contacts · Calendar · Notes · Filters
23
Security fixes applied
From XSS to brute-force protection
MIT
Open source license
Free to use, modify, and self-host
Everything you need

A complete mail suite, not just an inbox

Netifi Mail ships with everything modern email users expect — built in, no plugins required.

Universal IMAP/SMTP

Connects to any mail server — Gmail, Outlook, Yahoo, iCloud, Fastmail, cPanel, Dovecot, Postfix. If it speaks IMAP, Netifi Mail works with it.

Auto Server Detection

Just enter your email address. Netifi Mail auto-discovers your IMAP and SMTP settings via MX lookup, Mozilla ISPDB, and autoconfig — no manual setup needed.

App Password Ready

Modern providers like Gmail and Outlook require App Passwords. Netifi Mail detects your provider and shows step-by-step instructions with a direct link to generate one.

Rich Text Compose

Compose emails with a full TipTap rich text editor. Bold, italic, lists, links, inline images, signatures, vacation responder — everything you expect from a modern mail client.

Calendar (CalDAV)

Built-in calendar with month/week/day views, event creation, and CalDAV sync. Schedule and manage events directly from your webmail without switching apps.

Contacts (CardDAV)

Full contact manager with CardDAV sync. Import from CSV or vCard, export, search, and harvest contacts from emails you receive automatically.

Notes

Markdown-powered notes app built right into your mail client. Write, organise, and search notes without leaving your inbox. Synced per user, stored securely.

Mail Filters & Rules

Create powerful rules to automatically sort, label, or delete incoming mail. Full CRUD filter management with condition matching on sender, subject, and body.

Universal Search

Context-aware search across mail, contacts, and notes from a single search bar. Global cross-folder search finds messages anywhere in your mailbox instantly.

Mobile Responsive

Fully responsive layout optimised for phones and tablets. Pull-to-refresh, floating compose button, full-width mobile sidebar, and icon-only compact controls on small screens.

Conversation Threads

Toggle between flat and threaded conversation views. Related messages are automatically grouped by subject, making long email chains easy to follow.

Dark & Light Theme

Carefully designed dark and light themes that adapt to every panel and component. Theme preference is saved per user across sessions.

Visual tour

Beautiful at every screen size

Designed for real work — not just demos. Every view is optimised for clarity and speed.

sarah@company.com × B I U 🔗 🖼 H1 H2 • 1. ✈ Send 💾 Save 📎 Attach 🗑

Rich Text Compose

Full TipTap editor with formatting toolbar, CC/BCC, attachments, and email signature

All Unread Starred 📱 Mobile View

Mobile-First Design

Full-screen mobile layout with pull-to-refresh, FAB compose, and touch-optimised controls

April 2026 Month Week + SunMonTue WedThuFriSat 3031 12 345 Team standup Release v2 67 89 101112 Client call 13 1415 1617 1819 Design review — 2pm 2021 2223 242526 Deadline 2728 2930 123

Built-in Calendar

Month, week, and day views with CalDAV sync and colour-coded events

+ Add Contact ⬆ Import CSV AK ✉ Email SM ✉ Email JR ✉ Email LP BW + New Contact

Contact Manager

CardDAV sync, CSV/vCard import, contact harvesting from received emails

Security First

Hardened from the ground up

Every layer of Netifi Mail is built with security in mind — from the session cookie to the email renderer.

DOMPurify HTML Sanitization

All HTML emails are sanitized with DOMPurify before rendering — including print preview. JavaScript URIs and CSS injection vectors are stripped.

Encrypted Session Cookies

Sessions are encrypted with iron-session using a mandatory user-provided secret. httpOnly, SameSite=Lax, 2-hour expiry. No plaintext tokens stored.

Rate Limiting & Brute Force Protection

Login endpoint locks out after 5 failed attempts for 15 minutes. Search, send, and autoconfig are independently rate-limited per user.

Header Injection Prevention

All email header fields (subject, from, reply-to) are validated against CRLF injection before passing to nodemailer — preventing email spoofing attacks.

TLS Always Enforced

Certificate verification is on by default for all IMAP and SMTP connections. Can only be disabled via explicit environment variable — never silently.

Content Security Policy

Strict CSP headers block inline scripts, external frames, and untrusted resource origins. CSRF protection via Origin header validation on all state-changing API calls.

SSRF & Input Validation

Autoconfig only fetches from verified public hostnames — RFC1918 and localhost addresses are blocked. Folder names, file uploads, and CSV imports are all validated and size-capped.

Attachment Safety

Uploads are limited to 25 MB per file and 50 MB total. Executable file types (.exe, .bat, .cmd, .ps1, .vbs, and more) are blocked at the API level.

How we compare

Best-in-class open-source webmail

Netifi Mail brings together features scattered across multiple competing projects — in a single, modern, self-hosted package.

Feature Netifi Mail Roundcube SnappyMail SOGo Cypht
Modern UI (post-2022 design)✓ YesPartial✓ Yes✗ No✗ No
Mobile Responsive✓ YesPlugin✓ YesPartialPartial
Pull-to-Refresh (mobile)✓ Yes✗ No✗ No✗ No✗ No
App Password Guidance✓ Yes✗ No✗ No✗ No✗ No
Auto Server Detection (MX)✓ Yes✗ NoLimited✗ No✗ No
Built-in Calendar✓ Yes✗ No✗ No✓ Yes✗ No
Built-in Contacts✓ YesPlugin✗ No✓ Yes✗ No
Built-in Notes✓ Yes✗ No✗ No✗ No✗ No
Mail Filters / Rules✓ YesPluginBasic✓ Yes✗ No
Rich Text Compose✓ Yes✓ Yes✓ Yes✓ Yes✗ No
Thread / Conversation View✓ YesPlugin✓ Yes✓ Yes✗ No
Global Cross-folder Search✓ YesPartialPartial✓ YesPartial
Dark Theme✓ YesPlugin✓ Yes✗ No✗ No
Built-in Security Hardening✓ 23 fixesPartialPartialPartialPartial
Setup ComplexityLow (npm start)MediumMediumHighMedium
Tech StackNext.js 14PHPPHPObj-C/JavaPHP
LicenseMITGPL v3AGPL v3LGPLAGPL v3

Comparison based on default installations. Features marked "Plugin" require third-party extensions. Data accurate as of 2026.

Get started

Up and running in minutes

No complicated server setup. No databases to configure. Just Node.js and your mail credentials.

1

Clone the repo

Get the source from GitHub. Requires Node.js 18 or later and npm.

2

Generate a session secret

Create a strong random key for encrypting session cookies. One command does it.

3

Build & start

Run the production build and start the server. Open your browser and log in.

4

Sign in

Enter your email — server settings are auto-detected. Use an App Password for Gmail or Outlook.

# 1. Clone git clone https://github.com/netifi-private-limited/netifi-webmail.git cd netifi-webmail && npm install # 2. Generate session secret (Linux / macOS) echo "SESSION_PASSWORD=$(node -e "console.log(require('crypto').randomBytes(32).toString('hex'))")" >> .env.local # 2b. Windows PowerShell $s = node -e "console.log(require('crypto').randomBytes(32).toString('hex'))" Add-Content .env.local "SESSION_PASSWORD=$s" # 3. Build & start npm run build && npm start # Or run with Docker SECRET=$(node -e "console.log(require('crypto').randomBytes(32).toString('hex'))") docker run -p 3000:3000 -e SESSION_PASSWORD=$SECRET netifi/webmail
100% Free & Open Source

Take back control of your email.

Stop paying for email SaaS. Stop trusting your private communications to third parties. Netifi Mail gives you a world-class webmail experience on your own infrastructure.