E2a: Open-Source Email Gateway for AI Agents with SPF/DKIM Verification and Webhook/WebSocket Delivery

E2a is an open-source email gateway designed to let AI agents send and receive emails as triggers. It provides authenticated transport — inbound mail is verified with SPF/DKIM, and every delivery includes HMAC-signed X-E2A-Auth-* headers. Agents receive mail via webhook (cloud mode) or WebSocket (local mode, no public URL needed). Outbound mail is sent via an HTTP API, supporting agent-to-agent (SMTP relay) and agent-to-human (upstream SMTP like SES or Resend) flows.

Key features from the source:

• Email threading stays consistent with agent conversation threading.
• Human-in-the-loop review for outbound emails, with approval via dashboard, magic-link email, or CLI.
• Quick onboarding/offboarding of email addresses for agents within minutes.
• WebSocket for local agents and at-least-once webhook delivery for cloud agents.
• Outbound API with optional HITL hold.
• Hosted version at e2a.dev with shared agents.e2a.dev domain for instant slug-based onboarding.

Self-hosting requires Docker. Clone the repo and run:

git clone https://github.com/Mnexa-AI/e2a.git
cd e2a
docker compose up -d

This starts Postgres (with auto-migrations), the API server on port 8080, SMTP relay on 2525, and a dashboard (Caddy + Next.js) on port 3000. Health check: curl http://localhost:8080/api/health.

Create a user and API key (no OAuth required):

docker compose exec e2a e2a -config /etc/e2a/config.yaml -bootstrap-email [email protected]

Register an agent and confirm:

KEY=e2a_...
curl -X POST http://localhost:8080/api/v1/agents \
  -H " Authorization: Bearer $KEY " -H " Content-Type: application/json " \
  -d ' {"slug":"my-bot","agent_mode":"local"} '
curl -H " Authorization: Bearer $KEY " http://localhost:8080/api/v1/agents

To receive real inbound mail, point your domain's MX record at the relay host. The project currently lacks DMARC support (only SPF/DKIM), scoped API keys, HA/multi-region, app-layer email data encryption, and compliance attestations (SOC 2/HIPAA).