Email is often perceived as a legacy utility, but operating a high-availability, low-latency mail service at global scale demands complex infrastructure. Fastmail operates independent infrastructure designed around open standards, high performance, and user privacy.
1. Storage Architecture: JMAP, IMAP, and Cyrus SAS
At the core of Fastmail’s data layer is the open-source Cyrus IMAP server, a highly performant mail store designed for massive concurrency and large mailboxes.
┌─────────────────────────────────────────────────────────────┐
│ Client Layer │
│ (Web App / Mobile App / Third-Party IMAP Clients) │
└──────────────────────────────┬──────────────────────────────┘
│ JMAP / IMAP HTTP APIs
┌──────────────────────────────▼──────────────────────────────┐
│ Application Layer │
│ (Authentication, Rate Limiting, Routing) │
└──────────────────────────────┬──────────────────────────────┘
│ Direct IPC / Local Sockets
┌──────────────────────────────▼──────────────────────────────┐
│ Storage Engine │
│ Cyrus SAS (Store and Search Architecture) │
│ ┌──────────────────────┐ ┌──────────────────────┐ │
│ │ Index Files (xapian)│ │ Raw Mail Spool (NVMe│ │
│ └──────────────────────┘ └──────────────────────┘ │
└─────────────────────────────────────────────────────────────┘
Mailbox Layout and Cyrus SAS
Unlike standard Maildir or mbox formats that suffer from high I/O overhead during search operations, Fastmail relies on Cyrus SAS (Store and Search):
- Append-Only Indexing: Email messages are stored on NVMe arrays as individual raw RFC 5322 files, while dynamic metadata (flags, read status, thread IDs) is stored in structured binary indexes.
- Xapian Integration: Full-text indexing runs alongside the storage engine using Xapian. Search queries execute directly against optimized inverse index structures rather than scanning raw message files.
2. Protocol Evolution: Transitioning from IMAP to JMAP
Fastmail co-authored JMAP (JSON Meta Application Protocol – RFC 8620) to solve the performance and efficiency bottlenecks inherent in legacy protocols.
| Feature | Legacy IMAP (RFC 3501) | JMAP (RFC 8620) |
| Data Format | Custom textual syntax (S-expressions) | Standard JSON payloads over HTTP/2 |
| Network Requests | Chatty; sequential round-trips for metadata | Batched API requests in a single HTTP payload |
| State Syncing | High bandwidth overhead (UID FETCH loops) | Efficient state strings (state tokens) |
| Push Synchronization | Requires long-lived TCP connections (IDLE) | WebPush / Server-Sent Events (SSE) compatible |
Technical Advantages of JMAP Push Synchronization
Under IMAP, mobile devices must maintain persistent TCP sockets using IDLE, causing battery drain and connection drops during network handoffs. JMAP decouples the transport layer:
- State Tracking: Every client request includes a
statestring representing the mailbox version. - Delta Querying: If the server state advances from
s1024tos1025, the client issues a standard JMAPEmail/changesrequest. - Targeted Updates: The server responds only with the IDs of created, updated, or destroyed records, drastically reducing payload size over cellular networks.
3. Inbound Mail Pipeline and Security Stack
When an external Mail Transfer Agent (MTA) delivers a message to Fastmail, the connection undergoes multi-layered inspection before reaching disk.
SMTP Inbound (Port 25) ──► TLS Termination (HAProxy) ──► Port25 / Postfix MTA
│
▼
Mail Filtering Pipeline ◄─────────┘
├── SPF/DKIM/DMARC Verification
├── Milter Inspection (Rspamd)
└── Sieve Engine Execution
│
▼
Cyrus Storage Engine (Write to Disk)
Security and Authentication Filters
- TLS Enforcement: Strict TLS negotiation with fallback options dependent on destination capabilities, enforcing modern cipher suites (TLS 1.3).
- DKIM & SPF Verification: Inbound messages are evaluated against DNS TXT records. Public keys validate the signature attached to the
DKIM-Signatureheader. - DMARC Processing: Aligns
Header: Fromwith SPF and DKIM domains. If verification fails, policy rules (none,quarantine,reject) determine message routing. - Rspamd Spam Filtering: Leverages neural network scoring, Bayesian learning, and real-time blacklists (RBLs) via a high-performance C/Lua filtering engine.
4. Custom Delivery Rules: The Sieve Processing Engine
Fastmail provides deep user-level control via Sieve (RFC 5228), an imperative, Turing-incomplete scripting language executed directly at the delivery stage.
Code snippet
require ["fileinto", "mailbox", "variables"];
# Fastmail Sieve Filter Example
if header :contains "X-Spam-Known-Sender" "yes" {
# Keep verified contacts in the inbox
keep;
} elsif header :contains "X-Spam-score" "5.0" {
fileinto :create "Junk";
} else {
keep;
}
Because Sieve runs inside the MTA delivery pipeline (LMTP stage) rather than on the user’s client device:
- Rules apply instantly across all devices without relying on an open client app.
- Email can be tagged, refiled, redirected, or dropped prior to index generation.
5. Privacy Architecture and Masked Email
Fastmail integrates Masked Email capabilities directly into its domain identity management stack. This allows users to dynamically generate unique email addresses mapped to specific web services.
Implementation Workflow
- Unique Addressing: Dynamic aliases are routed to a single account without requiring separate mailboxes or aliases table expansion.
- Metadata Separation: Third-party integrations (such as password managers via API) interact using scoped API tokens.
- Outgoing Sender Rewriting: Outbound messages sent via a Masked Address automatically rewrite headers to ensure the real user identity (
Account-ID) is never exposed in theSenderorFromheaders.
Technical Summary
Fastmail combines the reliability of battle-tested backend components like Cyrus with modern open standards like JMAP to deliver scalable, secure, and low-latency communication services. By handling indexing, security verification, and rule-based processing at the infrastructure layer, it maintains high performance even under heavy, concurrent global traffic.
Also Read: Dashlane Password Manager For Complete Digital Security
