OpenEFA-CN · AGPL-3.0 · community edition · release imminent
The open-source email gateway that learns from every node running it.
A Postfix content filter with 58 detection modules, ARC sealing and quarantine digests, built for a plain Ubuntu 24.04 server. Every node shares what it sees with the EFA Collective and gets the whole network's intelligence back.
What runs on a node
Detection you can read, scoring you can tune.
Every module is a Python file in the repository with its own score and its own log line. Nothing is a black box, and the same standards plumbing runs in the commercial editions.
Authentication and alignment
SPF, DKIM and DMARC evaluated per hop, ARC sealed on the way out so downstream servers trust your relay.
auth_results · arc_signer · header_forgery
Phishing and impersonation
Display-name spoofing, lookalike links, brand impersonation, thread hijack and reply-chain checks.
phishing_detector · display_name_spoofing · thread_awareness
Business email compromise
Payment and gift-card patterns, urgency language, first-contact senders, executive name matching per domain.
bec_detector · first_contact_detector · vip_alerts
Attachments and links
PDF inspection with embedded-link extraction, archive scanning, URL reputation with operator trust lists.
pdf_analyzer · attachment_scanner · url_reputation
Bounce and backscatter
Fake bounces, high-entropy sender domains and auto-reply loops scored before they reach a mailbox.
backscatter_detector · domain_entropy
Quarantine and digests
Per-user release, per-domain relay rules, daily digests, and a web UI with TOTP and passkey login.
quarantine_manager · digest · web
EFA Collective
Free to join. Contributing is the price.
Each node sends dispositions, template hashes and URL-set hashes for the mail it scores. Nothing with a subject, a recipient or a body leaves your server unless the sender is authenticated and the message was blocked. In return the node pulls indicators that every other node has already confirmed.
- Enrollment keys are issued per node, with rate limits sized for a small server.
- A node that pulls the feed but stops contributing is warned, then throttled, then read-only.
- What is sent is documented field by field in COLLECTIVE_CONTRIBUTION.md.
Your node · cn-01 · October
Editions
One codebase, two ways to run it.
OpenEFA-CN is the complete community gateway, not a trial. The commercial editions add the machine-learning scoring, archive and compliance modules, and the hosted service, and are run by Quantum Logic Systems.
OpenEFA-CN AGPL-3.0-or-later
- 58 detection modules, full web UI, quarantine and digests
- EFA Collective membership on the open tier
- Install on your own hardware or VM, any number of domains
- Support through the community forum and GitHub Issues
Public repository and installer open with the release. Pre-release notice
MailGuard and hosted editions commercial
- Everything in CN plus ML ensemble scoring and adaptive learning
- Archive, legal hold, compliance reporting, MSP portal
- Vetted Collective tier with higher limits
- Managed hosting and a support contract
Community
Questions in the forum, bugs in Issues.
The forum returns at openefa.org/forum with the threads from the first public year kept intact. Bug reports with logs go to GitHub Issues so fixes stay tied to commits.
News
The OpenEFA-CN public release is imminent
The community edition is in final testing. What is coming, what changes for 2025 installs, and how the forum comes back.