For two years, Forreast ran a self-hosted Stalwart mail server on the sovereign cluster. It worked — until it didn't. Scaling, deliverability, and the single point of failure became untenable.
The chosen architecture
- Inbound: Cloudflare Email Routing (free) →
ascendantsovereign@proton.me - Outbound: Brevo SMTP/API (free tier, 300 emails/day)
- SPF:
v=spf1 include:_spf.mx.cloudflare.net include:spf.brevo.com mx ~all - DKIM: Dual selectors — Brevo
key1._domainkey+ Cloudflarecf2024-1._domainkey - DMARC: Relaxed alignment for transition safety
Why hybrid
Cloudflare Email Routing is receive-only. You cannot reply as @forreast.com from Proton Free. Brevo handles outbound with authenticated DKIM signatures. The combination gives us free inbound forwarding and reliable outbound delivery without maintaining a mail server.
Aliases
All aliases — serik@forreast.com, sovereign@forreast.com,paradox@forreast.com, hello@forreast.com — route to the same Proton inbox. If Proton limits are hit, we can swap the destination to Gmail without touching DNS.