SecuredRelay: Self-Hosted Email Masking & Virtualization Engine
Self-Hosted Virtualized Email Ingestion and Cryptographic Header Routing Engine
System Architecture Overview
SecuredRelay operates on the fundamental premise of zero identity leakage through total header virtualization. When an external entity delivers an email to an alias, the message arrives at a catch-all mailbox managed by a custom ingestion poller. The ingestion worker parses raw MIME structures, strips origin headers, evaluates global and personal blocklists, and constructs an outbound envelope addressed to the user's primary mailbox. For two-way communication, the system generates a cryptographically sealed, URL-safe reply address containing an HMAC-SHA256 signature, creation timestamp, and randomized nonce. When the user replies to this address from their normal email client, SecuredRelay intercepts the message, authenticates the cryptographic token without requiring mutable state tables, restores the destination context, and sends the reply under the alias persona. The entire stack is architected to be modular and environment-agnostic, supporting standard shared hosting cron models, high-concurrency Docker daemons, and enterprise cloud infrastructure.
Problem Statement
Modern internet services mandate email addresses as persistent user identifiers, enabling data brokers, telemetry trackers, and advertisers to construct comprehensive behavioral profiles across disjoint platforms. When services suffer data breaches or sell marketing lists, personal inboxes become flooded with unfilterable spam, phishing campaigns, and credential stuffing vectors. Commercial masking services introduce recurring subscription fees, proprietary vendor lock-in, and central points of failure where untrusted third parties retain plaintext access to personal messages. SecuredRelay eliminates this vulnerability by empowering users to self-host a private, multi-domain alias virtualization infrastructure with verifiable end-to-end cryptographic routing and zero metadata leakage.
Architectural Blueprint
Stateless Cryptographic Reply Synthesis
Rather than persisting fragile, unbounded routing records for every email thread, SecuredRelay implements stateless token routing using the server master key. The ReplyRoutingService generates URL-safe Base64 reply addresses formatted as 'reply+{payload|hmac}@domain', combining the alias ID, sender address, timestamp, and 8-byte nonce. Incoming replies are verified in constant time via hash_equals, validated against a 90-day expiration window, and decoded on the fly without stateful session tracking.
Resilient 4-Tier Client API Resolution
The cross-browser Manifest V3 extension (compatible with Chrome, Microsoft Edge, and Firefox) avoids hardcoded backend couplings through an autonomous resolution hierarchy implemented in api-resolver.js. The client sequentially checks explicit user overrides, 24-hour cached endpoints, an external discovery endpoint (with a strict 3-second AbortController timeout), and an embedded fallback host. This allows administrators to migrate backend server infrastructure or rotate IP addresses seamlessly without forcing manual extension updates or breaking browser-based form injection.
Dual-Engine Poller Architecture with Concurrency Fencing
SecuredRelay balances deployment flexibility across varied hosting environments by decoupling continuous IMAP polling from server daemons. On constrained cPanel shared hosting, cron-poll.php executes an atomic file-locked 14-minute execution window polling mailboxes every 30 seconds; on containerized Docker and Azure App Service deployments, an Artisan daemon utilizes persistent IMAP ping loops and background worker queues. Both architectures share identical MIME parsing, loop rejection, and error recovery logic.
Engineered Feature Toolkit
Inline DOM Masking & eTLD+1 Domain Extraction
A lightweight Manifest V3 content script inspects DOM inputs using semantic heuristics and MutationObservers, injecting an inline action button that automatically derives the registrable domain and populates a new alias.
Multi-Domain & Domain Group Governance
Supports routing across multiple top-level relay domains, each equipped with dedicated SMTP/IMAP credentials, DKIM signing controls, and user authorization groups.
Pluggable Outbound Transport Drivers
An extensible transport factory dynamically routes outbound messages through RFC 5321 SMTP, Google Gmail REST API, or Microsoft Graph API based on per-domain configuration.
Two-Tier Hierarchical Blocklist Pipeline
Combines global administrative domain and email filters with individual user-managed blocklists, halting inbound spam at the gateway before queue dispatch.
Native Telegram Bot Integration
A comprehensive Telegram bot interface provides real-time email notifications, HTML-to-text sanitization, and full command-based alias lifecycle management.
One-Click In-App Git Auto-Updater
An administrative updater module executes git fetch, branch divergence inspection, atomic pull, dependency installation, and migration routines directly from the web interface.
Engineering Challenges & Solutions
In deployments monitoring numerous domains and high email volumes, administrative telemetry controllers executed repeated SQL queries within collection iterations to compute 24-hour activity and health metrics, degrading response times under load.
Replaced repetitive per-domain queries with cross-driver SQL aggregation expressions (SUBSTRING_INDEX on MySQL and SUBSTR on SQLite) combined with single-query groupByRaw projections. This optimized database execution from an O(N) loop into three vectorized queries, reducing API response times to sub-50ms.
Complex web applications and checkout forms frequently re-render, detach, or asynchronously insert input fields, resulting in orphaned generator buttons, duplicate DOM injections, and broken click listeners.
Engineered a debounced MutationObserver on document.body paired with a persistent 'data-securedrelay-processed' DOM attribute check. The script injects an absolutely positioned relative wrapper without modifying parent CSS layout rules and implements graceful error rollback if the background API request fails.
Technology Stack Breakdown
Core Engine
Storage & State
DevOps & Cloud
Measurable Production Impact
- 100% Header Anonymization: Completely strips origin IP addresses, destination mailboxes, and server routing metadata across forwarded emails and bidirectional reply threads.
- Sub-30-Second Inbound Forwarding: Delivers near-instantaneous email dispatch from catch-all mailboxes to target user inboxes via optimized polling loops and asynchronous job queues.
- Universal Deployment & Cross-Browser Reach: Verified seamless operation across Docker containers, Azure App Service, and cPanel Apache shared hosting, with uniform extension support across Chrome, Edge, and Firefox.
- O(1) Vectorized Admin Telemetry: Eliminated dozens of sequential database round-trips by batching domain health checks and alias metrics into single-pass SQL aggregations.