TLS & cipher control
Offer only the protocols and ciphers you choose — force TLSv1.0
and a weak cipher to reproduce a handshake failure.
Open source · Apache 2.0 · Java 21
Robin
MTA Server · SMTP Client · Tester
One jar, three tools for people who take email seriously: a socket-level SMTP client that reproduces any sender's misbehaviour, a deliberately breakable debug MTA, and a test engine whose assertions see the whole pipeline — not just SMTP codes.
A programmable bad actor
Most libraries hide the socket. Robin hands it to you — dial in the exact TLS, chunking, timing and protocol quirks of any real-world sender and reproduce interop bugs on demand.
Explore the client ServerA breakable MTA
Script failure scenarios per domain, inject chaos into any processor, and mail in diagnostic bots — or run it for real with Dovecot, durable queues, DoS protection and metrics.
Explore the server TesterAssertions that see everything
JSON test cases that run as JUnit in your CI. They don't just read SMTP replies — they grep your logs, log into IMAP, call your APIs and inspect MIME.
Explore the testerThe client
Reproduce the bug — don't guess it
Robin's SMTP client is controllable right down to the TCP writes. That's what lets it impersonate the precise misbehaviour of a real ESP and turn a flaky, unreproducible interop bug into a deterministic test.
CHUNKING / BDAT framing
Set the BDAT chunk size and split it across uneven TCP writes — exactly how different providers frame the wire.
Connection injection
Cut the connection after N bytes, or right before or after the final
<CRLF>.<CRLF> — mid-DATA disconnects on tap.
Slow-sender emulation
Add write delays every N bytes to emulate a slowloris or a struggling upstream.
AUTH quirks
AUTH-before-STARTTLS, combined LOGIN on one line, auth retries — replay the vulnerable behaviours clients really ship.
XCLIENT & custom params
Forge client identity with XCLIENT and inject arbitrary MAIL/RCPT parameters for proxy and filter testing.
The server
An MTA built for testing — and self-hosting
Outside your configured scenarios, everything is accepted. That candour is the point: an MTA you can see straight into, bend to any failure mode, and still run for real.
Failure scenarios
Return custom responses per domain and per verb — 501 at EHLO,
554 at DATA, per-recipient regex replies.
Chaos headers
Force the AV, spam, storage or Dovecot processor to fail on a single message — clean fault injection without breaking real services.
Diagnostic bots
Mail one in and get a reply: a full SMTP session trace, or a deliverability & security report — SPF/DKIM/DMARC, MTA-STS, TLS, DNSBL, and more.
DoS protection
Connection and rate limits, progressive tarpitting, slowloris guards — all on by default, all counted in Prometheus.
Durable queues
MapDB, Redis, MariaDB or PostgreSQL backends with geometric retry back-off.
Metrics everywhere
Micrometer to Prometheus & Graphite, plus Prometheus remote-write push to VictoriaMetrics, Mimir or Thanos.
ClamAV & Rspamd
Virus and spam scanning with separate reject and discard thresholds, symbol extraction and optional DKIM signing.
Webhooks that decide
Per-verb HTTP callbacks that can override the SMTP response — greylist, reject or accept from your own service.
The tester
Assertions that see the whole pipeline
A test case is a JSON file. It runs as a JUnit test, from the CLI, or over HTTP — so it drops straight into CI/CD. And it asserts on far more than the SMTP reply.
Beyond SMTP codes
- Logs — grep your MTA logs, require or refuse patterns, capture values into variables.
- IMAP — log in and prove the message landed: match headers, MIME parts, decoded body, even content hashes.
- HTTP APIs — POST/PUT/DELETE against your own endpoints and assert the response.
- Negotiated TLS — assert the exact protocol and cipher that were used.
The magic system threads data through a whole test — capture a UID from a log line and assert on it in the next envelope. Build MIME on the fly, including generated PDFs, with auto Message-ID and Date.
{
"mail": "{$mail}",
"rcpt": ["{$rcpt}"],
"assertions": {
"protocol": [
["MAIL", "250 "],
["RCPT", "250 "],
["DATA", "250 Received"]
],
"external": [
{ "type": "imap", "folder": "INBOX",
"wait": 5, "retry": 6,
"match": { "message-id": "{$MSGID}" },
"delete": true },
{ "type": "logs",
"grep": [["Custody=true", "Storage=check"]],
"refuse": ["NullPointerException"] }
]
}
}
In production, Robin runs as synthetic monitoring across 25+ environments every three hours — submitting mail, reading it back over IMAP, asserting the full transcript and delivery, and alerting Slack the moment anything drifts.
Host your own email — in one compose file
The full suite pairs Robin with everything a real mail server needs. One command, and you're running a complete, inspectable stack — no black boxes.
Robin MTA
SMTP server + Service & Client APIs
Dovecot
IMAP / POP3 + LMTP delivery
Roundcube
Webmail front-end
ClamAV
Virus scanning
Rspamd
Spam & phishing detection
PostgreSQL
Shared auth, queue & data
# Robin + Dovecot + Roundcube + ClamAV + Rspamd + Postgres $ docker compose -f .suite/docker-compose.yaml up -d
Single responsibility, reusable libraries
Robin is built to come apart. Every piece is a standalone, Apache-2.0 Java library you can drop into your own tools.
- MTA-STS + TLS-RPT
- DANE / TLSA
- MX resolver with policy
- Dovecot SASL
- IMAP helper
- MIME parsing & building
- Header Wrangler
- Received-header builder
- HTTP request client
Get Robin
Open source under Apache 2.0. Star it, fork it, file an issue, or send a merge request — contributions of any kind are welcome.