Complete data privacy and ownership in your own AWS account. High-throughput serverless SES processing, IAM ABAC access control, modern React webmail, and 1-click CloudFormation deployment.
A fully managed cloud email experience without paying per-mailbox SaaS markups
SES receipt rules stream incoming messages directly into S3 and trigger Go Lambda parsers over SNS for instantaneous MIME decoding, spam verdicts, and indexing.
Outbound email is sent directly from the browser to SES using temporary scoped IAM credentials from Cognito Identity Pool, eliminating server bottlenecks.
DynamoDB LeadingKeys and S3 sub-path policies enforce strict tenant data isolation at the AWS IAM authorization layer. Users cannot touch other mailboxes.
Automated SNS feedback loops capture SES deliveries, bounces, and complaints. DynamoDB GSIs update message statuses in real time.
Sleek, responsive web client featuring custom Cognito auth, folders (Inbox, Sent, Drafts, Trash, Spam), rich text compose, and instant client-side full-text search.
Native DMARC XML aggregate report ingestion, automated parsing, Bayes spam scoring, virus verdicts, and per-user whitelist/blacklist rule sets.
Zero idle EC2 servers, zero operating system patching, and infinite automatic scaling
Internet SMTP → AWS SES Inbound → S3 Raw Object → SNS Topic → Go Lambda Inbox. The Lambda decodes MIME, checks DynamoDB blacklist/whitelist, processes attachments into S3, and records the item in DynamoDB.
Browser SPA authenticates via Amazon Cognito. Scoped IAM credentials authorize SES SendEmail directly. No backend proxy is required, eliminating network hops and API scaling bottlenecks.
When an email is removed or its TTL expires, DynamoDB Streams trigger an asynchronous Cleanup Lambda. Orphaned S3 attachments and raw emails are purged automatically.
Security enforced in the AWS control plane, not just in application code
Even if webmail client code were modified, users cannot read or write another person's emails. AWS IAM policies restrict DynamoDB operations to partitions matching cognito-identity.amazonaws.com:sub.
Attachments are segregated under attachments/${sub}/*. Temporary credentials generated by Cognito Identity Pool restrict S3 GetObject and PutObject strictly to the authenticated user's prefix.
Automated DNS configuration for Route 53 with automated 2048-bit DKIM keys, SPF records, and DMARC enforcement to guarantee maximum email deliverability and thwart spoofing.
Bootstrap credentials and admin passwords are automatically generated and stored in AWS Secrets Manager, with zero cleartext credentials stored in code repositories.
DevSkill Mail is packaged for automated provisioning using modern IaC standards. Deploy via AWS Marketplace CloudFormation or manage using modular Terraform.
mail.yaml provisions SES, Cognito, DynamoDB, S3, Lambdas, and CloudFront seamlessly/config.jsContact our team for a private offer, proof-of-concept deployment, or tailored email migration
We verify your Route 53 domain zone, AWS region selection, and SES production sending limits.
Launch via CloudFormation or Terraform with your custom domains, branding, and Cognito user policies.
Verification of DKIM, SPF, DMARC, ACM SSL certificates, and SES receipt rule execution.
Receipt of admin credentials from Secrets Manager, user provisioning, and webmail walkthrough.