← Back to Research

AfterSMTP is a pre-alpha Go prototype for an encrypted messaging protocol and an SMTP bridge. It is not production mail-hosting software or a stable internet standard.

It acts as a secure, decentralized bridge, allowing a seamless transition from legacy plain-text SMTP to the fully encrypted Advanced Message Protocol (AMP).

Core Features

  • Native End-to-End Encryption: Built deeply on modern cryptographic primitives. All payloads are mathematically locked using X25519 authenticated encryption.
  • Decentralized Identities (DIDs): Email addresses (e.g., user@domain.com) map to did:aftersmtp:domain.com:user. Identities, along with Ed25519 signing keys, are stored on a public Substrate/Merkle-based blockchain transparency log.
  • Authenticated AMP ingress: Native gRPC and QUIC handlers verify signed AMP envelopes before delivery.
  • QUIC transport: The implementation uses custom QUIC streams carrying protobuf AMP messages. It is not an HTTP/3 API.
  • Trusted-delivery controls: Durable grants, sender reputation, emergency denies, and rate limits are active in the gateway.
  • Legacy SMTP bridge: SMTP can bridge into local encrypted AMP inboxes. Authenticated submission can also deliver to external MX hosts when explicitly enabled with DKIM and a real EHLO identity.

Project Structure

  • /cmd/aftersmtp: The primary gateway monolithic server.
  • /cmd/aftersmtp-cli: The cross-platform CLI tool for identity management and messaging interactions.
  • /internal/protocol/amp: The native AMP protocol gRPC and QUIC ingress services.
  • /internal/protocol/legacy: The highly secure On-Ramp and Off-Ramp integrations for legacy SMTP software.
  • /internal/crypto: The X25519/Ed25519 payload sealing primitives.
  • /internal/ledger: Substrate blockchain clients (with SQLite-backed fallback features).
  • /internal/security: Strong implementations of DKIM signatures, ARC seals, and DANE/DNSSEC resolution.
  • /library/: Notes for future SDK generation; no released cross-language SDK is present.

Getting Started

Installation

You can build the server and the CLI tools utilizing the standard Go toolchain:

# Build the core monolithic server
go build -o aftersmtp ./cmd/aftersmtp 

# Build the CLI tool
go build -o aftersmtp-cli ./cmd/aftersmtp-cli

Initializing the Fallback Ledger Environment

If a local Substrate blockchain node is not available, the system will degrade gracefully into an SQLite-backed embedded local store (fallback_ledger.db).

To utilize the CLI in this mode, initialize the schema first:

./aftersmtp-cli db init

# Generate your first decentralized identity and encryption key matrix
./aftersmtp-cli keygen msgs.global ryan

# Verify storage
./aftersmtp-cli db list

Trusted-delivery beta controls

The gateway now starts its recipient-control plane by default. It stores only consent, reputation, and first-contact metadata in trust.db; encrypted message payloads stay in the inbox store.

# Default migration mode: accept mail, but enforce sender blocks and rate limits.
AFTERSMTP_TRUST_MODE=observe

# Native AMP beta mode: require a recipient grant before native delivery.
# SMTP bridge traffic stays in observe mode because SMTP does not provide a
# verifiable sender DID yet.
AFTERSMTP_TRUST_MODE=require_consent
AFTERSMTP_TRUST_DB_PATH=/var/lib/aftersmtp/trust.db

# Host several local domains without opening MX ingress to everyone.
AFTERSMTP_DOMAIN=gomeow.media
AFTERSMTP_RELAY_DOMAINS=brooklyncats.show,bedstuy.studio

# Optional Internet SMTP egress. This accepts only TLS-authenticated submission,
# requires both envelope and visible From addresses to use one of the hosted
# domains above, requires DKIM signing, and requires STARTTLS at the destination.
# Publish smtp._domainkey TXT records for each hosted domain using this key.
AFTERSMTP_LEGACY_OUTBOUND_ENABLED=true
AFTERSMTP_EHLO_HOSTNAME=smtp.gomeow.media
AFTERSMTP_DKIM_SELECTOR=smtp
AFTERSMTP_DKIM_PRIVATE_KEY_PATH=/run/secrets/aftersmtp-dkim.pem

# Operator controls. Use the same trust database path as the gateway.
./aftersmtp-cli --trust-db /var/lib/aftersmtp/trust.db trust grant \
  did:aftersmtp:sender.example:alice did:aftersmtp:msgs.global:ryan
./aftersmtp-cli --trust-db /var/lib/aftersmtp/trust.db trust block \
  did:aftersmtp:abusive.example:spam
./aftersmtp-cli --trust-db /var/lib/aftersmtp/trust.db trust unblock \
  did:aftersmtp:abusive.example:spam

Before switching a production domain to require_consent, make grants for the expected native correspondents and monitor observe-mode admission logs.

Documentation

Explore the following documentation files for deep technical understanding: - PROTOCOL.md: Details the mechanics of the AMP protocol, how DNS mapping operates, and the cryptographic layout. - INTEGRATION.md: Guide on marrying existing enterprise mailboxes (Postfix, MS Exchange) into the AfterSMTP ecosystem via hybrid gateways. - COMMUNICATION_REQUESTS.md: Consent-first delivery state and the request protocol status.

Current beta boundary

The project can be used for local and controlled-pilot evaluation of native AMP ingress, SMTP-to-local-inbox bridging, authenticated SMTP egress, trust admission, and inbox storage. It is not ready to operate as a public Internet MX or general outbound relay: gRPC TLS, certificate fail-closed behavior, recipient control APIs, durable outbound retries, and live interoperability testing remain incomplete. MX ingress is fail-closed to AFTERSMTP_DOMAIN plus explicit relay_domains entries; external SMTP egress is disabled unless explicitly configured. See PROTOCOL.md for transport-level details.

Protocol Libraries Let the World Speak AMP

Check the /library/ folder for .proto source-of-truth definitions and generate bindings required for external clients to engage natively in the Next-Generation.