Architecture · Published 26 August 2026
Owning the recipient MX path from SMTP greeting to signed event
A boundary-by-boundary design for accepting mail directly, persisting it durably, and projecting minimal signed metadata.
The MX record is an authority declaration
A domain that points its MX at Ruzayo asks Ruzayo to become the authoritative receiving edge. That is different from forwarding mail to a parsing address: SMTP acceptance, recipient validity, queueing, raw-message custody, and retry semantics all become part of the product boundary.
The edge must therefore resolve the recipient inside one verified tenant before accepting a message as deliverable.
Separate edge, delivery, and storage
Postfix handles internet SMTP and protocol hardening. Accepted messages cross an internal LMTP boundary into the mailbox service, which persists the raw source and a normalized record under one stable message identity.
The canonical store is not reconstructed from a webhook. Webhooks are projections for consumers, not the mailbox database.
Sign the minimum useful projection
Events carry stable identifiers, bounded metadata, timestamp, audience, and replay identity. Consumers verify the signature against the exact bytes before changing workflow state.
Large bodies and attachments stay behind owner-scoped retrieval rather than being sprayed into every webhook destination.
Custody implies exit
Domain verification, credential rotation, mailbox export, and removal need the same rigor as creation. The owner must be able to retrieve its messages and DNS state without an undocumented operator step.
Sovereignty is not a slogan about geography alone; it is explicit authority, inspectable transport, and a tested exit path.
Production checklist
- Verify Direct recipient MX against the deployed environment, not a screenshot.
- Verify Tenant-scoped authority against the deployed environment, not a screenshot.
- Verify Signed webhooks against the deployed environment, not a screenshot.
- Verify Exit remains possible against the deployed environment, not a screenshot.