mailsink

An SMTP server for test and development networks. Applications on other machines send mail to it as they would to a real server. It accepts mail for the domains you allow and discards it.

• Nothing is kept. Message bodies are read off the socket and discarded as they arrive. They are never held in memory as a whole or written to disk, and the container's filesystem is read-only.
• Nothing is relayed. The server contains no code that opens an outbound connection, and the runtime image has only its one static binary: no MTA, no shell, no network tools. Mail to a domain outside the allowlist gets 550 5.7.1 at RCPT TO.
• Only local clients. Connections from addresses outside ALLOWED_NETWORKS get 554 and are closed.
• No logging. The server writes nothing while it runs, and the compose file sets Docker's logging driver to none.

Configure

All settings are build arguments at the top of the Dockerfile, with comments explaining each one. They are compiled into the binary, so the running container reads no environment variables or config files. To change a setting, edit the Dockerfile and rebuild. A bad value fails the build.

Setting	Default
ALLOWED_DOMAINS	example.test,*.example.test (* accepts any domain)
ALLOWED_NETWORKS	the RFC 1918 ranges and fc00::/7
SMTP_HOSTNAME	mailsink.test
SMTP_PORT	25
MAX_MESSAGE_SIZE	26214400 (25 MiB)
MAX_RECIPIENTS	100
MAX_CONNECTIONS	100

Run

docker compose up -d --build
sudo ./egress-lockdown.sh      # optional second layer; see below

Point applications at the Docker host on port 25. Any username and password are accepted, so apps configured for authenticated SMTP work unchanged. There is no TLS: clients must allow a plaintext connection.

ALLOWED_NETWORKS is checked against the client's source address. Clients on the network reach the container through Docker's NAT, which keeps their real address. A connection from the Docker host itself goes through Docker's userland proxy, so it appears to come from the bridge gateway (in 172.16.0.0/12). If you narrow ALLOWED_NETWORKS, tests run on the host itself will be refused.

Blocking egress at the firewall

Docker can't publish a port from an internal network, so the container sits on a normal bridge (br-mailsink). egress-lockdown.sh adds iptables rules that drop every new connection starting from that bridge, both out to the network and to the Docker host itself. Inbound SMTP and its replies still pass. Run it as root after the container is up, and again after a reboot. --remove takes the rules out. The script assumes Docker's iptables firewall backend.