Give out disposable alias@domain addresses that forward to your real inbox — and reply through them too. You never hand out your real address; only disposable aliases. Replies route back through a reply+<token>@yourdomain reverse alias, so the sender only ever sees the alias.
The whole service — daemon and alias store — fits in one small, portable APE binary, configured in typechecked Dhall. The same C core also builds to WebAssembly and runs fully client-side in your browser.
visage.com APE binary, no VM, no runtime, no database process.reply+<token> address so your real address stays hidden.visage.comA single self-contained ~2.6 MB polyglot binary — an Actually Portable Executable built with cosmocc. The same file runs on Linux, macOS, Windows, and the BSDs with no VM, no runtime, no recompile.
An SMTP receiver with a typechecked Dhall config, alias + reverse-alias forwarding, STARTTLS relay (optionally cert-verified), DKIM signing, and a durable outbound retry queue.
visage.wasmThe real C config + alias pipeline compiled to a small .wasm module. It runs 100% client-side — the actual config_load + address resolution, no server, no build step. Your config and addresses never leave the tab.
| Area | Capabilities |
|---|---|
| Config | Typechecked Dhall record (aliases, domains, relay, limits, storage, DKIM) evaluated at startup — config errors surface before the daemon binds a port. |
| SMTP | Hand-rolled RFC 5321 state machine for receiver and relay (HELO/EHLO, MAIL, RCPT, DATA) with full bounds-checking on the wire path. |
| Store | datalog-dafsa minimal-DAFSA store: fixed-width big-endian keys, symbol interner, WAL + flock, mmap zero-copy reads. Prefix-search lookups, no separate index. |
| Delivery | Durable outbound retry queue (spooled to disk, bounded retries), STARTTLS / STARTTLS-verify relay, DKIM signing. |
| Reply | Reverse-alias reply routing via reply+<token>@domain — 32-hex-char tokens from /dev/urandom, 30-day TTL. |
Two things stay small as you grow: the server is one ≈2.6 MB APE binary, and its alias store is a minimal DAFSA that shares prefixes and suffixes across every key — on-disk size is ~480 B/alias at 1,000 aliases and ~542 B/alias at 1,000,000, roughly constant across three decades.
Email routing needs exactly two lookups, and both are native DAFSA primitives: forward routing (alias@domain → destinations) and reverse reply routing (reply+<token> → sender) are byte-prefix walks, O(prefix length) regardless of alias count.
The SMTP receiver (src/smtp_in.c) parses the envelope, gates on served domains, and resolves each alias@domain case-insensitively against the DAFSA store, falling back to catch-all.
Accepted mail is spooled to disk and handed to the outbound queue (src/smtp_out.c): bounded retries, STARTTLS to the relay, DKIM-signed before it goes out.
When you reply, the reply+<token>@yourdomain reverse alias (src/reply.c) routes back to the original sender — the sender only ever sees your alias.
git submodule update --init --recursive # fetch vendor/dhall-c + vendor/datalog-dafsa make # builds visage.com (APE) + *_check tools make wasm # → docs/visage.js + docs/visage.wasm node tests/wasm-smoke.js # headless smoke test of the wasm module
config.example.dhall.