How It Works

Architecture

MailOven runs two servers:

1. SMTP server — receives incoming emails on port 25
2. Web server — serves the inbox UI and REST API

When an email arrives at anything@acme.mailoven.com, the SMTP server:

1. Extracts the domain from the recipient address (acme.mailoven.com)
2. Looks up the organization by slug (acme)
3. Parses the email (subject, from, body) using MIME parsing
4. Sanitizes the HTML body (strips scripts, dangerous tags)
5. Stores the email in the database, linked to the organization

Catch-all behavior

You don't need to create inboxes ahead of time. Any address at your subdomain is valid:

signup-test@acme.mailoven.com
password-reset@acme.mailoven.com
order-confirmation-42@acme.mailoven.com

Each unique to address becomes its own inbox in the UI.

Multi-tenancy

Every organization is fully isolated:

• Emails are scoped to your organization — no one else can see them
• Team members must be explicitly invited
• API keys only access your organization's data
• Subdomains are globally unique

Email retention

Emails are automatically deleted after a configurable number of days (1–20, default 30). You can change this in Organization Settings → Settings → Email Retention.

A background job runs hourly to purge expired emails.

Security

• All passwords are hashed with bcrypt
• Sessions are signed with HMAC
• Every form is protected with CSRF tokens
• HTML email bodies are sanitized before storage
• API keys are scoped to a single organization