The SMTP (RFC 821) mail protocol is over forty years old, has been through a lot and it won't go anywhere. But so do I! In recent months I had been asking myself what if we just remade it from scratch? But why, you ask?

Let's be honest: email is a trust issue pretending to be a transport protocol. Every address needs a certificate authority somewhere behind it, every inbox needs spam filtering that reads your mail to decide whether to deliver it, and the identity you have used for twenty years was never really yours: it is a record in somebody else's database.

smolmail is my remake attempt and it throws most of that out. An address, a key and a message, and nothing between them that has to be trusted. One 32-byte master key is the only secret: back it up, and everything else, the signing key, the encryption key, the key that lets someone send you mail at all, can be rebuilt from it. Five operations, four cryptographic primitives created for entirely different reasons, zero extensibility mechanisms. No certificates. No expiry. No CA.

A smolmail address can be the ordinary kind, alice@example.org, resolved through a server the way email already works. Nothing new to learn here. Or it can carry its own key, smol://alice@example.org/mfrggzdf..., easily shared by QR code or link, trusting no server at all. Either way, changing servers doesn't change who you are, because in smolmail the address is just that: a place, not you.

The part I like best is what replaces spam filtering. A smolmail server never reads a word of what passes through it, simply because it can't! Every message is sealed before it leaves the sender. What stops abuse instead is quotas and accept tokens: mail from someone you haven't accepted lands in a separate "Requests" tier, capped and rate-limited, and accepting someone pushes a token straight to their server so their next message arrives in your regulat "Inbox". The one who decides what is spam, is you.

None of this is abstract: the protocol itself lives at smolmail, alongside a reference server and client deliberately vibe-coded as a single Python file each to demonstrate the protocol's coherence, with dependencies declared inline so there is nothing else to install.

smol.place is the one place actually running it, with a webmail client for anyone who doesn't want to touch a terminal, and it is still being built in public. Addresses work, the webmail is new, and I wouldn't call any of it finished.

What I didn't expect, starting this, was how fast the reference implementation would stop being the only one. There is a Rust server now, a Rust client library other things embed, a browser client, a desktop app, a daemon that turns the same sealed mail into a feed reader. Each of those is its own story, and none of them make sense without this one first. This is the one to read before any of the others.

Repository

smolmail