The one difference that drives all the others: per server, not per mailbox

Most email security is sold per mailbox, per month. That model is fine until you grow, at which point every new hire raises your security bill, and the cost of protecting a 500-person company is roughly ten times the cost of protecting a 50-person one, for the same software. Hermes is licensed per server. One flat license protects every mailbox behind it, so your cost is tied to your infrastructure, not your headcount. For an SMB or an MSP protecting many small clients, that is usually the whole argument.

Hermes vs Mimecast and Proofpoint

Mimecast and Proofpoint are excellent enterprise platforms with threat intelligence and security operations that are genuinely best-in-class, and a self-hosted gateway does not replace a vendor-run global SOC. What Hermes matches is the core defenses an SMB actually needs, spam and malware filtering, encryption, full DMARC, and time-of-click link protection, while keeping your mail on infrastructure you control and your bill flat. If that comparison is what brought you here, we go deeper on it on the self-hosted Proofpoint / Mimecast alternative page.

Hermes vs Microsoft 365 (EOP / Defender)

If you already run Microsoft 365, its built-in filtering (Exchange Online Protection) is a baseline, and the stronger protection lives in Defender for Office 365, a separate license. Both tie your email security to the same vendor that runs your mail, which is the opposite of defense-in-depth. Hermes runs in front of M365 as an independent filtering and encryption layer, so a gap or outage on one side is not a gap on both, and it brings full SPF/DKIM/DMARC/ARC tooling that M365’s native controls only partly cover. See Hermes in front of Microsoft 365.

Hermes vs mailcow, iRedMail, and other self-hosted mail servers

These are good projects, and if all you want is to host your own mailboxes, they do that well. The distinction is category, not quality: they are mail servers, and Hermes is a security gateway that also happens to include a full mail server. You do not have to choose. Point Hermes in front of your existing mailcow or iRedMail and it adds the inbound threat filtering, encryption gateway, and DMARC tooling those servers do not focus on, while they keep hosting your mailboxes. Or run Hermes as the whole stack and retire the separate pieces.

Hermes vs rolling your own

You can assemble Postfix, SpamAssassin, ClamAV, Dovecot, OpenDKIM, and an encryption gateway yourself. Plenty of people have. But integrating the daemons is the part people overestimate their way past. The real cost is everything that turns a pile of services into a product you can actually operate, and two pieces of that are easy to forget until you are staring at a config file.

• The admin console. Raw Postfix, Dovecot, and OpenDKIM do not come with a management UI. You get config files and a command line. Everything the Hermes console does from a browser, adding domains, generating DKIM keys, searching and releasing quarantine, training the spam filter, managing encryption keys and TLS certificates, reading DMARC reports, and configuring relay and mail flow, would be a web application you design, build, and maintain yourself, on top of every one of those daemons.
• The end-user portal. Hermes also gives your users a self-service portal for their own signatures, Sieve rules, vacation replies, app passwords, and mobile-device profiles. Roll-your-own gives them none of that. It is a second custom application to build and support.
• The packaging. Hermes ships as a curated, integrated container stack, purpose-built images for the Hermes-specific services alongside standard off-the-shelf ones, tied together by a single compose file and a one-command update orchestrator, so the whole deployment is reproducible and portable. Roll-your-own is either bare-metal, tied to one host’s package versions and fragile to upgrade, or you assemble, containerize, orchestrate, and maintain that whole arrangement yourself. That is a third layer Hermes has already done for you.

Wiring the open-source pieces together is a matter of weeks. Building the two custom web UIs that make them manageable, and keeping them working across every component upgrade, is a software product in its own right, realistically months to years for a small team, and the maintenance never ends. Then there is the ongoing operational tuning, feed updates, TLS renewals, auth, spam scoring, and version upgrades, that lands on you forever either way. Hermes is those same open-source components, pre-integrated, wrapped in a mature admin console and user portal, deployed with one docker compose up and updated with one more.

The trade-offs

Three trade-offs to weigh:

• You run it. Self-hosting means you own the uptime, the backups, and the upgrades. That is the trade for owning your data and your bill. Hermes makes it a one-command deployment and update, but it is still your server.
• No vendor SOC. Hermes gives you the defenses and the architecture, not a 24/7 managed threat-hunting team. If you need that under a vendor’s name, the big SaaS suites still lead.
• The Docker edition is an early-adopter track. It is stable and actively developed, but if you run production mail, test upgrades in your own environment first. Every release is shaped by that feedback.