Email that actually Delivers
A fast, modern, open-source mail client for you and your team. Self-host it in minutes, connect any IMAP/SMTP mailbox, and keep your mail where it belongs — with you.
Open by default
Every line of the client and the server is public and AGPL-licensed.
Private by design
Your mail stays on your mail server. Delivr streams it, never archives it.
Standards first
Plain IMAP and SMTP. No proprietary sync, no lock-in, no walled garden.
Yours to host
One Docker Compose file, your server, your domain, your rules.
Everything an inbox needs. Nothing it doesn't.
Delivr covers the full mail workflow — without ads, tracking, cloud lock-in, or a data-mining business model.
One inbox, every account
Connect any number of IMAP/SMTP accounts and switch between them instantly — work, personal, and that old address you still check.
A composer that keeps up
Rich text, attachments, priorities, Cc/Bcc, and drafts that are saved straight to your server's Drafts folder.
Identities & signatures
Send as multiple addresses from one account, each with its own HTML signature and a sensible default sender.
Search with operators
Find anything across all folders with from:, to:, subject:, has:attachment, is:unread, before: and after: filters.
Folders, your way
Create, nest, and rename folders, drag mail between them, and map Sent, Drafts, Trash and Archive to the folders you actually use.
Bulk actions
Select many messages with Shift, Ctrl or the keyboard, then archive, move, delete or mark them read in one go.
Tracking pixels blocked
Remote images are blocked until you allow them, per sender or per domain. HTML mail is sanitized before it is rendered.
Verified brand logos
Senders with a BIMI record show their brand logo, so you can tell the real bank from the phishing attempt at a glance.
Installable everywhere
Delivr is a Progressive Web App. Install it on Windows, macOS, Linux, Android or iOS and it updates itself.
Privacy is architecture, not a settings page
Delivr was designed so that it simply cannot leak what it never keeps. Mail is read live from your IMAP server, parsed in memory, and sent to your browser — then it's gone.
- No mail cache on disk, no attachment store, no search index to steal.
- Remote content is blocked by default, so senders can't see when you read.
- No analytics, telemetry, or phone-home — not even an update check.
- User accounts and roles
- Session tokens & API keys — hashed with Argon2id
- IMAP/SMTP credentials — encrypted with AES-256-GCM
- Preferences, identities, and signatures
- Message bodies and headers
- Attachments — streamed with Cache-Control: no-store
- Address books harvested from your mail
- Analytics, telemetry, or read receipts
Search the way you think
Type plain words or combine operators. Delivr searches every folder of the account at once and remembers your recent searches.
Also: to:, subject:, before:, is:unread, is:flagged, is:unreplied …
An API you'll actually want to use
Everything the web app can do, you can script. Every route is documented with OpenAPI and browsable in an interactive reference on your own instance.
$ curl https://api.mail.example.com/v1/mail-accounts \
-H "Authorization: Bearer dla_apikey_…"
{ "success": true, "code": 200, "data": [ … ] }Secure defaults, auditable code
Security in Delivr isn't a premium tier. It's built into every request — and because it's open source, you don't have to take our word for it.
Encrypted credentials
Mail-server passwords are encrypted at rest with AES-256-GCM and a key only you hold.
Hashed tokens
Sessions and API keys are random 256-bit secrets, stored only as Argon2id hashes.
Safe rendering
DOMPurify sanitization, a remote-content gate, and an inert-only attachment preview list.
Brute-force limits
Login attempts are rate-limited per client and per username out of the box.
Built in the open. Owned by everyone.
Delivr is licensed under the GNU AGPL-3.0. The code, the issues, the roadmap, and the discussions all happen in public on GitHub — and contributions of every size are welcome.
Delivr Web
The installable web client and PWA your users sign in to.
Nuxt 4 · Nuxt UI · TypeScript
Delivr API
The backend that talks IMAP/SMTP, authenticates users, and serves the REST API.
Bun · Hono · Drizzle ORM
Website & Docs
This site — the landing pages and the documentation you are reading.
Nuxt 4 · Nuxt Content
1.0 is the beginning
Here's a taste of what's planned after the first stable release. The full roadmap is public — and shaped by the people who use Delivr.
Shared team inboxes
Share a mailbox like support@ or hello@ with your team, so everyone works from the same inbox without sharing a password.
Offline-first PWA
Keep recent mail in a local cache on your device, search it offline, and queue messages written offline until you're back online.
End-to-end encryption
OpenPGP in the browser, with Mailvelope support and your own keys, so only the recipient can read a message.
Enterprise single sign-on
Sign in to Delivr with your identity provider over OpenID Connect or SAML — Keycloak, Authentik, Entra ID, Okta and more.
Local AI spam & phishing detection
Classify spam and phishing with small open models that run on your own hardware. No mail ever leaves your server.
Calendars & contacts
CalDAV and CardDAV integration for calendars, invitations, and address books — the full groupware experience in one app.
Up and running in five minutes
Delivr ships as two container images. Point them at a domain, put a reverse proxy in front, and you're live.
# 1. Grab the Compose file and an encryption key
$ mkdir delivr && cd delivr
$ curl -o docker-compose.yml https://www.delivr.email/static/docker-compose.yml
$ openssl rand -hex 16 # → DLA_ENCRYPTION_KEY
# 2. Set your domains and key, then start Delivr
$ docker compose up -d
# 3. Open the one-time admin setup link
$ docker compose logs delivr-api | grep reset-passwordReady to take your inbox back?
Open source, self-hostable, and built to play nicely with the email server you already have.