Postfix Insights vs Mailgraph: volume graphs versus search and correlation (2026)
Mailgraph is a lightweight Perl daemon that watches the Postfix maillog and produces RRDtool time-series graphs of message volume: sent, received, bounced, rejected, and (with milter data) spam and virus. Postfix Insights is an interactive search and dashboard system that offers message-level lookup, queue-ID correlation, and a delivery-health dashboard. They are fundamentally different tools designed for different jobs: Mailgraph excels at a simple, always-on volume trend; Postfix Insights excels at point-in-time diagnosis, per-recipient status tracking, and SLA measurement. This guide shows where each shines and where they complement each other.
What is Mailgraph?
Section titled “What is Mailgraph?”Mailgraph, written by David Schweikert, is a Perl script that runs as a daemon, parses the Postfix maillog, and updates an RRDtool database (mailgraph.rrd). The daemon feeds a CGI script that generates simple PNG graphs showing message volume (sent, received, bounced, rejected) over daily, weekly, monthly, and yearly windows. A web server serves these graphs on a small static page for at-a-glance visibility into mail traffic trends.
One operational note worth weighing: the graphs are produced by a CGI script with no built-in authentication. Securing that endpoint is your responsibility. Gate it at the web server, require TLS, and keep it off the public Internet unless you intend it to be public. The CGI execution model is lightweight but dated, and the exposure is yours to manage.
Mailgraph has been a sysadmin tool for years because it is:
- Minimal: a single Perl script daemon with RRDs module as the main dependency.
- Reliable: proven behavior across many Postfix deployments; near-zero complexity.
- Low-overhead: the daemon consumes negligible CPU and memory; graphs update continuously in real time.
- Self-contained: no database schema to manage, no multi-component architecture, RRD files are the data store.
- Always on: once running, graphs are ready without cron schedules or manual reporting steps.
It is genuinely unbeatable for the job it does: an instant, lightweight visual of mail volume trends over any time window.
What is Postfix Insights?
Section titled “What is Postfix Insights?”Postfix Insights is a self-hosted FastAPI application that exposes two surfaces over the same Postfix maillog data:
- Interactive search by recipient, domain, or subject (with optional date range). Results are parsed and correlated by queue ID into structured per-recipient delivery records, showing raw log lines and formatted status. Results stream to the browser via Server-Sent Events.
- Delivery-health dashboard (
/stats) that aggregates volume, bounce and defer rate, SLA, domain mix, slow domains, DSN breakdown, and calendar/heatmap trends. A background scanner rolls log data into hourly, daily, and weekly tiers in a libSQL store so trends stay fast across months of mail.
Postfix Insights runs as a long-lived service (typically in Docker) against local logs or SSHFS-mounted remote logs. It exposes a web UI at a configurable port.
Core structural difference
Section titled “Core structural difference”| Capability | Mailgraph | Postfix Insights |
|---|---|---|
| Output format | PNG time-series graphs (RRDtool) | Web UI (search + dashboard) |
| Execution model | Daemon (continuous updates) | Long-lived service |
| Deployment model | CGI script run by a web server (no built-in auth) | Self-contained service (one process, no CGI surface) |
| Volume trend graph | Yes (daily/weekly/monthly/yearly) | Yes (heatmap and aggregate charts) |
| Point-in-time message lookup | No | Yes (by recipient, domain, subject) |
| Queue-ID correlation | No | Yes (per-message, per-recipient status) |
| Per-recipient delivery status | No | Yes (detailed per-recipient DSN) |
| DSN reason breakdown | No | Yes (bounces, defers by reason code) |
| SLA measurement | No | Yes (delivery percentiles, slow domains) |
| Dashboard | No | Yes (aggregated stats, trends, heatmap) |
| Remote logs (SSHFS) | No | Yes |
| TLS / DKIM coverage | No | Yes (outbound TLS version; DKIM signing rate) |
| Setup overhead | Minimal (install daemon, point at maillog, start) | Moderate (Docker, libSQL sidecar, environment variables) |
| Footprint | ~10 MB disk (RRD files) | ~50-200 MB (SQLite tier storage, depends on log volume) |
Where Mailgraph excels: if you want a simple, lightweight, always-on visual of message volume trends without any search or correlation capability, Mailgraph does exactly that with near-zero overhead and minimal configuration. It is simpler and more efficient for that specific job.
Where Postfix Insights excels: if you need to look up a specific recipient’s recent delivery status, diagnose a domain’s bounce pattern by DSN reason, measure SLA, or observe per-message details over weeks, Postfix Insights provides interactive drill-down, queue-ID tracing, and historical analysis that Mailgraph does not offer.
Use cases and recommendations
Section titled “Use cases and recommendations”Use Mailgraph when
Section titled “Use Mailgraph when”- You want an always-on visual of mail volume trends (sent, received, bounced, rejected) over daily/weekly/monthly/yearly windows.
- You are comfortable with RRDtool graphs and have a web server to host the CGI output.
- Your primary need is a quick sanity check of mail traffic without interactive diagnosis.
- You operate a single mail server and need minimal overhead.
- You have no appetite for running a modern web application or containerized service.
Use Postfix Insights when
Section titled “Use Postfix Insights when”- You need to investigate a specific message’s delivery path (find it by recipient, domain, or subject; see the per-recipient status and DSN).
- You want to discover trends: which domains are slow, where bounces are concentrated by reason, whether SLA is holding.
- You operate multiple mail servers and want a single pane of glass (via SSHFS mounts).
- You prefer interactive diagnosis over static graphs.
- Your team uses dashboards and needs per-message correlation for support escalations.
Use both
Section titled “Use both”The two tools are not mutually exclusive. Both read the same maillog file, so there is no conflict. Many operators run Mailgraph for the simple, always-on volume graph (a traditional, lightweight visual) and Postfix Insights for interactive diagnosis and the /stats dashboard. This gives you both the lightweight trend and the rich diagnostic pane.
For example:
- Mailgraph runs as a daemon, updating RRD files and serving graphs on your web server. You can glance at the graphs anytime to see volume trends.
- When something needs investigation (a domain has high bounce rate, a recipient reports delivery delays), you open Postfix Insights, search, and drill into per-message details and DSN breakdowns.
- The
/statsdashboard shows you multi-week SLA metrics and slow-domain lists that Mailgraph’s graphs cannot.
This combination leverages the strengths of both: lightweight always-on trending plus interactive diagnosis.
Getting started
Section titled “Getting started”If you have chosen Postfix Insights and want to install it, see the Quick start guide for Docker setup in four commands.
For Mailgraph, download the script from the Mailgraph GitHub repository, install dependencies (RRDs, File::Tail), start the daemon, and point a web server to serve the generated graphs. The Debian mailgraph man page and the README in the repository provide setup instructions.
Both tools read the same maillog file, so there is no conflict in running both. Mailgraph will parse logs and update RRD files; Postfix Insights will parse logs and build its SQLite tier store on its own schedule. Each operates independently.