Haraka

A Node.js SMTP server built around plugins, used as a spam-filtering gateway or an authenticated submission and outbound relay in front of existing mailboxes.

5.6k stars, 719 forks JavaScript On GitHub since March 2011

Visit website View on GitHub How to run it

Haraka at a glance

Open sourceYes, MITNo paid parts in the repository
Health70 of 100Actively developed
Self-hostingDockerSteps in the README
InterfaceEnglish onlyNo translation files found
Issue repliesWithin ~6 hoursMedian first reply; 76% of recent issues answered

What is Haraka?

Haraka is a mail transfer agent written in asynchronous JavaScript. Each SMTP transaction passes through hooks such as connect, helo, mail, rcpt, data and queue, and short plugins attach to them to accept, reject, rewrite or route messages without blocking on slow DNS, Redis or HTTP lookups. The plugin registry covers authentication, DNS blocklists, DKIM, SpamAssassin, rspamd, ClamAV and queue backends. Mail flagged for relaying goes to a built-in outbound delivery engine. Haraka does not store mail or speak IMAP, so it sits in front of a mailbox server and forwards accepted messages to it; out of the box it forwards to a configured SMTP host.

Good fit if

  • You need a filtering front end ahead of Exchange, Dovecot or another backend, in place of a paid email security gateway.
  • You run high-volume mail submission or relaying and want custom routing rules written in JavaScript.
  • Your team already works in Node.js and wants to extend the mail server in that language.

Look elsewhere if

  • You want mailboxes, IMAP and webmail in one package: Mox or Mailcow.
  • You need a sending platform for applications with a web interface: Postal.

Before you adopt it

Haraka is MIT-licensed, and the repository contains no paid parts. Matt Sergeant started it in 2011; Matt Simerson is the current maintainer, and four authors committed in the last 90 days. Version 3.4.0 came out in November 2026. Installation goes through npm and requires Node.js, and a Docker setup is available. Since Haraka covers only SMTP, you still need separate software for mail storage and client access.

Drafted with AI from the project's README and repository data, then checked against that data on 7 November 2026. Report a correction

How to run Haraka yourself

One-click install

Not listed in the app catalogs of Umbrel, YunoHost, TrueNAS, Unraid, CasaOS, Runtipi, Proxmox VE Helper-Scripts and Coolify.

Ways to install

Docker files
Dockerfile or compose file in the repository
Compose file
None in the repository
Setup effort
Not rated: no compose file to judge from
Kubernetes
No Helm chart in the repository
Desktop and mobile
No app builds in GitHub releases
Interface languages
English only

Install instructions: haraka.github.io or the README on GitHub.

Haraka health: is it still maintained?

70 of 100, actively developed

Release rhythmEvery ~25 days14 releases in 12 months; latest v3.4.0
Issue repliesWithin ~6 hoursMedian first reply; 76% of recent issues answered
Bus factorMedium riskThe most active of 4 authors wrote 65% of recent commits
  • Activity
    26 commits in the last 90 days, the latest on 6 November 2026.
    17 / 30
  • Contributors
    4 people wrote the 26 commits of the last 90 days; the most active wrote 65% of them.
    9 / 20
  • Releases
    14 releases in the last 12 months; the latest, v3.4.0, on 5 November 2026.
    19 / 20
  • Replies to issues
    Maintainers answered 76% of recent issues, with a median first reply after 6 hours.
    18 / 20
  • Security practices
    OpenSSF Scorecard 6.8 of 10.
    7 / 10

Read from GitHub on 12 November 2026. How the score works

Haraka security

Security advisories are the vulnerabilities the maintainers disclosed on GitHub, with the versions that fix them; many advisories can mean careful disclosure as much as weak code. OpenSSF Scorecard checks how a project is developed and released: reviews, protected branches, pinned dependencies, signed releases. It does not audit the code itself.

Security advisories7 published5 high; all list a fixed version
OpenSSF Scorecard6.8 of 10How the project is built and released
Security policyYesExplains how to report a vulnerability

Latest advisories

All 7 advisories on GitHub

What each Scorecard check found

  • Binary files10 / 10No compiled binaries checked into the repository
  • Dangerous workflows10 / 10No risky patterns in GitHub Actions
  • License file10 / 10A license file is present
  • Maintained10 / 10Steady commits and issue activity in the last 90 days
  • Security policy10 / 10Explains how to report a vulnerability
  • Token permissions8 / 10Some CI tokens have more rights than they need
  • Static analysis6 / 10Code is scanned for bugs on some changes
  • Code review3 / 10Some changes are merged without review
  • Best-practices badge2 / 10Working towards the OpenSSF Best Practices badge
  • Fuzzing0 / 10No fuzz testing found
  • Pinned dependencies0 / 10Dependencies are not pinned to fixed versions

Advisories read from GitHub on 12 November 2026. From the OpenSSF Scorecard of 2 November 2026; checks that do not apply to Haraka are left out.

Haraka license: is it open source?

Haraka uses MIT, an open-source license approved by the OSI.

  1. March 2011First published on GitHub.
  2. TodayMIT.

Haraka for developers

Written in

  • JavaScript 98%
  • Shell 1%
  • HTML <1%
  • Dockerfile <1%
  • Perl <1%

Getting involved

Contributing guideYesCONTRIBUTING.mdOpen issues0On GitHub
Authors, 90 days4Of 26 commits
Donations2 waysGitHub Sponsors, Patreon

Language shares are GitHub’s count of the code in the repository.

Alternatives to Haraka

  • Maddy Mail ServerComposable all-in-one mail server. 73 health · GPL-3.0 · 6.1k stars
  • MailuInsular email distribution - mail server as Docker images 76 health · MIT · 7.6k stars
  • docker-mailserverProduction-ready fullstack but simple mail server (SMTP, IMAP, LDAP, Antispam, Antivirus, etc.) running… 80 health · MIT · 19.7k stars
  • Stalwart Mail ServerAll-in-one Mail & Collaboration server. Secure, scalable and fluent in every protocol (IMAP, JMAP, SMTP,… 57 health · Unidentified license · 15.9k stars
  • Mail-in-a-BoxMail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy… 53 health · CC0-1.0 · 15.5k stars

All 17 projects in Email servers & webmail

Questions about Haraka

Is Haraka open source?

Yes. Haraka is published under MIT, an OSI-approved open-source license.

Is Haraka still maintained?

Its health score is 70 of 100 (actively developed). It had 26 commits in the last 90 days, the latest on 6 November 2026, and its latest release came out on 5 November 2026.

How do I run Haraka?

You can run it with Docker. The README on GitHub has the exact steps.

What is Haraka written in?

Haraka is written mainly in JavaScript (98% of the code), by GitHub’s count of the repository.

What are the alternatives to Haraka?

Close alternatives in the Email servers & webmail category include Maddy Mail Server, Mailu, docker-mailserver.