Why WireGuard for Mail?
A mail server is a high-value target. IMAP, SMTP, and webmail interfaces face constant scanning, brute-force attacks, and vulnerability probes from every corner of the internet. Every open port is an invitation. Every login page is a surface for credential-stuffing.
WireGuard changes the equation. Instead of exposing your mail server's authentication surfaces to the world, you close them entirely. Users connect through an encrypted WireGuard tunnel — and only then can they reach the mail server. To the internet at large, there is no login page. No IMAP port. No SMTP submission endpoint. Nothing to attack.
What This Means in Practice
Before WireGuard
- Webmail login page visible to every IP on earth
- IMAP and SMTP ports open to brute-force attacks
- Rate limiting and fail2ban playing catch-up with automated scanners
- Every authentication attempt logged — most of it hostile noise
- Zero-day in your mail server software? Exploitable from anywhere
After WireGuard
- No mail ports visible to the public internet. None.
- Authentication happens at the WireGuard layer first — strong cryptographic identity before any mail protocol is spoken
- Failed authentication attempts drop to near zero — only your known peers can even attempt a connection
- A zero-day in Dovecot or Postfix is irrelevant to an attacker who cannot reach the server
- Public MX records still receive mail normally — inbound SMTP on port 25 remains open through the mail gateway, which is hardened separately
Inbound Mail — The Public Face
It's worth being precise about what is and isn't hidden. Inbound mail delivery still works normally. Your domain's MX record points to the mail gateway, which accepts mail from other servers on port 25 — the same way every mail server on the internet works. The gateway runs multiple layers of filtering (SpamAssassin, DNS-based blocklists, virus scanning) before delivering clean mail to the internal server.
What WireGuard removes is the client access surface — the ports and pages your staff use to read and send mail. Those are the surfaces that attackers probe for credentials. Those are what WireGuard makes invisible.
Outbound Mail
Staff sending mail do so through the same WireGuard tunnel. Their mail client connects to the internal SMTP submission address. The mail server authenticates the user, signs the message with DKIM, and relays it out through the gateway. From the outside, outbound mail looks identical to any properly configured mail server — SPF-aligned, DKIM-signed, DMARC-compliant.
What About Webmail?
Webmail is simply another service behind the tunnel. SOGo, Roundcube, or any webmail interface runs on an internal address. Users access it through their browser over the WireGuard connection. No webmail URL is published. No webmail login form is reachable from the internet. The only way to see the login page is to already be inside the encrypted tunnel.
Multi-Site Access
WireGuard works identically whether the lawyer is at their desk, at home, or on a mobile device. The tunnel is a lightweight kernel module — always-on, negligible battery impact, reconnects automatically. Staff at a branch office connect through their own WireGuard peer. A lawyer appearing in Brisbane connects from their laptop. The mail experience is identical — the tunnel is transparent to the mail client.
Is This Practical for Law Firms?
Yes. The setup we deploy for Kimpton Lawyers and Kimbri Law uses exactly this architecture. Mail flows normally. Staff read and send mail through Outlook, Apple Mail, or their preferred client — they don't think about WireGuard, it's just connected. The difference is that the server logs show zero brute-force attempts against user mailboxes, because there is nothing for an attacker to brute-force.