The route hijack was RPKI valid because they spoofed Hetzner's AS into the AS_PATH and Hetzner used a max length of /24 on the ROA (https://bgp.tools/rpki-history?cidr=162.55.0.0%2f16&asn=2494...).

I personally believe the real fix would be to incentivise the use of CAA records, ideally including the accounturi parameter.

Thundermail uses Stalwart

I really like where Stalwart is going, but I am quite hesitant to use it when basically all commits are authored by a single person. What would happen if he abandons the project or disappears?

Why not? If it goes away, it would take years until it rots and becomes unusable. And given that it uses open standard, it would be pretty simple to take a backup (which you should be doing regularly anyways) and move somewhere else.

If you're not afraid of the CLI a standard configuration management solution like Ansible would work well.

NAT is a workaround, not a fix.

Sounds interesting! Do you already have a website for this project?

> redistributing a proprietary app

Revanced patches the locally installed version, so hopefully that means they'll be in the clear

Yes! I'm currently using https://usefathom.com/, works pretty great