System design

How the architecture holds its boundary

A production system is defined by what it refuses as much as what it accepts. One house operates the servers, DNS state, mailbox record, and delivery route in eu-north-1 while preserving a documented export path.

Control planes

Postfix edge

Postfix terminates recipient SMTP and hands accepted messages to the internal LMTP boundary.

Authoritative mailbox store

The mailbox service owns durable raw messages, normalized records, domain state, and export.

Signed event boundary

Downstream systems receive minimal signed projections rather than authority over the mailbox store.

Request lifecycle

verify a name and DNS state
  → create a tenant-scoped mailbox
  → accept SMTP at the recipient MX
  → deliver internally over LMTP
  → persist raw and normalized message
  → emit signed metadata event and expose owner export

Failure model

Invalid tenant credentials, unverified domains, stale signatures, replayed events, and non-canonical recipients fail closed before tenant data is exposed.

Verification checklist

Direct recipient MX: Ruzayo is the receiving MX; it does not require forwarding through a third-party parser.
Tenant-scoped authority: Every domain, mailbox, message, credential, and export is resolved inside one tenant.
Signed webhooks: Webhook consumers verify signature, timestamp, audience, and replay identity before acting.
Exit remains possible: Domains and mailbox data retain an explicit, owner-authorized export path.

← Back to overview