Vexm Platform Architecture & Setup
Learn how Vexm orchestrates domain ownership verification, Amazon SES inbound receipt rules, private MinIO object storage, and catch-all routing without exposing AWS infrastructure.
1. System Architecture
Vexm operates on an asynchronous event-driven pipeline. When an email is sent to any address on a verified custom domain (e.g. support@yourdomain.com), the SMTP session connects to Amazon SES.
- Inbound SMTP message arrives at regional Amazon SES endpoint.
- SES receipt rule evaluates active domain and writes raw RFC822 EML to private storage.
- SNS webhook or queue worker triggers Vexm ingestion pipeline.
- Laravel worker extracts MIME parts, parses headers, decodes attachments, and sanitizes HTML.
- Metadata is indexed into PostgreSQL with strict tenant ownership scoping.
- Message appears in real-time in the web dashboard.
2. Required DNS Records
To route mail to Vexm, you configure exactly two DNS records in your domain registrar (such as Cloudflare, Route53, Namecheap, or GoDaddy):
Used to cryptographically prove that you own or manage the domain before routing is activated.
Instructs global MTAs (Gmail, Outlook, Yahoo) to deliver emails addressed to your domain to the SES inbound cluster.
3. Security & Isolation Architecture
Security is implemented as a fundamental core principle across the application:
Database records are strictly filtered by authenticated user ID. Insecure direct object reference (IDOR) attacks are blocked via authorization policies.
All incoming HTML is stripped of scripts, external redirects, frames, and event handlers to prevent XSS and malicious phishing attacks.
4. REST API Overview
All dashboard functionality is powered by the versioned REST API at /api/v1.