Mail Proxy

1. Simple Meaning

A Mail Proxy in Nginx is like a middleman for email traffic — similar to how a reverse proxy works for websites, but here it’s for email protocols like:

• SMTP (sending mail)

• IMAP (reading mail)

• POP3 (downloading mail)

Instead of connecting directly to the mail server, your email client connects to Nginx Mail Proxy, which then forwards the connection to the correct mail server.

---

2. Real-Life Example

Imagine:

• You have two mail servers — one for Gmail, one for Outlook.

• You want to provide one single address to users: mail.example.com.

• Users connect here, and Nginx decides which actual server to send them to.

Like a post office front desk:

• Customer hands you a letter (email connection).

• You check where it needs to go.

• You forward it to the right delivery office (mail server).

---

3. Why Use Mail Proxy?

• Single Entry Point → Users don’t need to remember different server addresses.

• Security → Hide actual mail server IPs from public.

• SSL/TLS Offloading → Nginx handles encryption before passing to backend.

• Load Balancing for Mail → Distribute connections among multiple mail servers.

• Protocol Handling → Can support IMAP, POP3, SMTP in one place.

---

4. How it Works in Nginx

Nginx listens for email client connections on ports like:

• 25, 465, 587 → SMTP

• 110, 995 → POP3

• 143, 993 → IMAP

When an email client connects:

1. Nginx authenticates the user (via a backend or script).

2. Based on authentication, Nginx selects the right mail server.

3. Nginx forwards traffic between the client and the mail server.

---

5. Example Nginx Mail Proxy Config

mail {
    # Enable mail proxy for POP3, IMAP, SMTP
    server {
        listen 143;        # IMAP
        protocol imap;
        proxy_pass_error_message on;
        proxy on;
        starttls on;
        ssl_certificate /etc/ssl/cert.pem;
        ssl_certificate_key /etc/ssl/key.pem;
        auth_http 127.0.0.1:9000/auth;
    }

    server {
        listen 25;         # SMTP
        protocol smtp;
        proxy on;
        starttls on;
        ssl_certificate /etc/ssl/cert.pem;
        ssl_certificate_key /etc/ssl/key.pem;
        auth_http 127.0.0.1:9000/auth;
    }
}

Key parts:

• protocol imap/smtp/pop3 → Defines which protocol the block handles.

• starttls on; → Allows upgrading from plain to encrypted connection.

• ssl_certificate → Handles SSL encryption.

• auth_http → Calls an HTTP backend to authenticate users and tell Nginx which server to use.

---

6. Where It’s Used in Real Life

• Large companies with multiple mail clusters behind one public address.

• ISPs offering email hosting for many domains.

• Mail services that hide backend changes (you can move mail servers without changing client settings).

---

7. Advantages

• Centralized security & SSL

• Easier scaling

• Easier migration between mail servers

• Unified configuration for multiple domains