Your own mailbox relay

Last updated: 24 September 2026

Herkos mail travels as sealed envelopes (NIP-59 gift wraps) and waits on the relays in your DM relay list until your app collects it. Most public relays hand those envelopes to anyone who asks. Nobody can open them, but anyone can count who receives mail and when, and the relay can delete them whenever it likes.

A relay of your own that asks who is reading (NIP-42) gives your envelopes to you and to nobody else, and keeps them for as long as you decide. This page explains how to set one up in three steps. It takes about fifteen minutes if you already have a server.

Which relay to use

We ran both candidates on 24 September 2026 and checked what they actually do with mail, not what they advertise.

	nogringo/nostr-relay	HAVEN 1.2.2
Who can read your envelopes	Only you, after identifying	`/chat`: anyone in your web of trust, after identifying. `/inbox`: anyone, with no identification
Who can deliver mail to you	Any sender who identifies	Only your web of trust
Deleting mail you received	Yes	No
Fast resync (NIP-77)	Yes	No
Licence	MIT	MIT

Use nogringo/nostr-relay as your mailbox. It is the one that does what mail needs: anyone can write to you, and only you can read. HAVEN is a good tool for other things (a personal outbox, media, private notes), but as a mailbox it would turn away mail from anyone you do not follow, including the bridge that carries ordinary email.

What you need

A machine that is always on and reachable from the internet: a small VPS (about 4-6 € a month) or a computer at home.
A domain or subdomain pointing to it, for example relay.example.com.
Docker and a reverse proxy that provides HTTPS. The examples use Caddy, which gets the certificate on its own.

Step 1: run the relay

git clone https://github.com/nogringo/nostr-relay
cd nostr-relay
cp .env.example .env

Edit .env: give the relay a name (RELAY_NAME) and set RELAY_URLS to its public address, wss://relay.example.com.

Then open docker-compose.yml and change the port line to "127.0.0.1:3334:3334". The relay trusts the address the proxy forwards to it when it checks who is identifying, so it must only be reachable through the proxy. Start it:

docker compose up -d

Step 2: put HTTPS in front

With Caddy, the whole configuration (/etc/caddy/Caddyfile) is:

relay.example.com {
    reverse_proxy 127.0.0.1:3334
}

Reload Caddy (sudo systemctl reload caddy). Opening https://relay.example.com in a browser should now answer.

Step 3: tell Herkos

In Herkos, open Settings → Network and servers → Your own relay and tap Check a relay. Enter wss://relay.example.com.
Herkos connects and tries it: it asks for someone else's mail, and it leaves a test envelope from a stranger (then deletes it). You should see Only you can read your mail here and Accepts mail from any sender.
Tap Make it your first DM relay, and Save at the top.

Keep a public relay in the list as well, second: if your server is down, mail still has somewhere to wait. relay.damus.io is a good second choice, because it also asks who is reading.

Good to know

It is a general-purpose relay. Besides your mail it accepts public notes from anyone, so other people could store things on your server. It has no setting to refuse them yet.
Mail from ordinary email arrives through a bridge, which has to identify when your relay asks. If ordinary email stops arriving after the change, the public relay you kept in the list will still receive it.
Back up the data. The envelopes live in the Docker volume relay-db. Herkos keeps its own copy of the mail it has collected, but mail that has not been collected yet exists only there.
Your IP address. The relay sees the address of every app that connects to it, as any relay does. On your own server, the only one who sees them is you.