System Requirements
This page describes the server hardware, operating system and prerequisites you need to prepare before starting a DeepFilter installation. Check the tables here before you begin; the installer passes over some shortcomings with nothing more than a warning, while one of them stops it altogether.
Minimum Hardware
The values below are the recommended minimum requirements. They vary with how the organization uses the system, but they are sufficient for traffic in the range of 1,000-5,000 emails per day. When resource usage is observed to stay consistently high, the hardware should be increased. How to scale for your own volume is covered in the capacity and disk sections on this page.
| Component | Minimum |
|---|---|
| vCPU | 4 |
| RAM | 8 GB |
| Disk | 100 GB |
| Architecture | x86_64 |
DeepFilter runs several services on a single server: email reception and delivery, the scanning engine, antivirus, databases, the analytics engine, cache, a local DNS resolver and the web interface. The minimum values are intended for low-volume installations.
The ARM architecture is not supported. Installation is only possible on x86_64 servers.
How vCPUs Are Counted
How many vCPUs you assign to the server matters: this total is one of the values used when calculating the number of concurrent workers DeepFilter will run (see the Concurrent Worker Count section below for details). This is why the correct vCPU count has to be assigned when planning resources.
What matters here is the total number of vCPUs, not how those vCPUs are split into sockets and cores. In your virtualization manager, 4 sockets × 1 core and 1 socket × 4 cores give the same result; both are 4 vCPUs.
DeepFilter evaluates processor power on the basis of the total number of logical processors. For example, 3 sockets × 2 cores and 1 socket × 6 cores give the same result: 6 vCPUs. What matters is not the split but the total number of vCPUs assigned to the server. You are free to choose the split on your virtualization platform.
Concurrent Worker Count
This section is the most commonly misunderstood topic when sizing a server, and it should be read carefully.
DeepFilter runs concurrent worker processes that scan emails in parallel. This number is calculated automatically during installation and follows this rule:
Worker count = the lower of the total vCPU count and the RAM ceiling (minimum 2)
The RAM ceiling is as follows:
| Server RAM | Worker upper limit |
|---|---|
| Below 8 GB | 2 |
| 8 – 15 GB | 3 |
| 16 GB and above | 4 |
RAM limits the core count. Giving the server plenty of vCPUs while leaving RAM low does not increase the worker count. A real example: on a server with 6 vCPUs and 7.5 GB of RAM, the worker count stays at 2, because RAM is below 8 GB. If you want to grow capacity, increase vCPU and RAM together.
The reason for this ceiling is that the databases, the analytics engine, the cache and the antivirus all use memory on the same server. Growing the worker count by looking at cores alone creates memory pressure when RAM is tight and slows down the entire system.
The worker count can be changed manually after installation. This is a system administrator task, and the relevant services have to be restarted after the change; otherwise the new setting does not take effect.
Pre-Installation Checks
The installer inspects the server before it starts. On the hardware side there is only one hard requirement: free disk space.
| Requirement | Threshold | What happens below the threshold |
|---|---|---|
| vCPU | 4 | Issues a warning, installation continues |
| RAM | 7.5 GB | Issues a warning ("risk of insufficient memory"), installation continues |
| Free disk space | 50 GB | Raises an error, installation stops |
Installation also stops in the following non-hardware situations:
| Check | If the condition is not met |
|---|---|
| Operating system (Rocky Linux 9, x86_64) | Installation stops |
| System clock synchronization | Installation stops |
| An existing DeepFilter installation on the server | Installation stops |
The vCPU and RAM warnings do not block installation, but do not ignore them. A server installed with insufficient resources will experience scanning delays and a growing email queue as traffic increases. In addition, RAM below 8 GB permanently pins the worker count at 2.
Operating System and Prerequisites
DeepFilter runs on Rocky Linux 9 Minimal (x86_64) only. If another distribution or a different major version is detected, installation stops before it starts.
The Rocky Linux 9 Minimal installation must be used. In Workstation (desktop) or full (Server with GUI) installations, the preinstalled web server, email server and local name resolution services may occupy the ports DeepFilter uses.
The installer expects the following ports to be free: 25, 80, 443, 3000, 5432, 6379, 9443, 9445.
If these ports are occupied, the installer issues a warning but does not stop; the problem surfaces after installation. The installer checks whether the server is Rocky Linux 9, but it does not detect the difference between Minimal and Workstation. Choosing the right variant is the administrator's responsibility.
Before starting the installation, make sure the following are ready on the server:
- Root access — the installation command is run with root privileges.
- A clean server — a system dedicated to DeepFilter, with no other email server or web server running on it.
- A working DNS resolver — access to package repositories and domain names is required during installation.
- firewalld — firewall rules are configured through this service.
- A synchronized system clock — if the clock drifts noticeably, installation stops. A drifting clock breaks certificate validation.
- Internet access — installation packages are downloaded from remote repositories.
Offline installation (without internet) is not supported. Installation packages are downloaded from remote repositories; installation cannot complete on a server without internet access.
Capacity
Processing capacity and disk requirements are two separate topics and should not be confused. Processing capacity is a matter of CPU and RAM; it determines how many emails can be scanned per day. Disk requirement, on the other hand, is a matter of retention; it is calculated from the sustained daily average and the retention period. This section covers processing capacity, while the Disk Sizing section below covers storage space.
Traffic of up to 200,000 emails per day is recommended for a single DeepFilter server. This limit is the upper band within which a single server operates comfortably under the scanning chain (spam analysis, antivirus, analytics recording).
Organizations above 200,000 emails per day scale horizontally: several independent DeepFilter servers are installed and the load is distributed by pointing MX records at those servers with equal priority. See the Horizontal Scaling page for details.
The capacity figure is not a fixed guarantee. The server's actual hardware, the size of attachments and the distribution of traffic over the day (for example a bulk surge concentrated in the morning hours) all change effective capacity. For traffic profiles with heavy attachments or sudden peaks, take the hardware above the minimum.
An Observation from the Field
On a server with 16 GB of RAM and 6 vCPUs, 380,000 emails were processed in a single day. That is a peak day figure; it is not a sustained daily average. It does not mean the system will handle that volume every day.
In that configuration the concurrent worker count is 4: 16 GB of RAM raises the worker ceiling to 4 according to the RAM ceiling table in the Concurrent Worker Count section above, and since 6 vCPUs stays above that ceiling, RAM is the deciding factor.
The recommended limit of 200,000 emails per day stays clearly below that peak observation. The gap exists to leave room for traffic fluctuations and for peak hours during the day.
Disk Sizing
The calculation here is based on the server's sustained daily average email count and on a one-year retention period. Single-day peak values do not enter this calculation; what determines the disk requirement is not how much the system can process over a day, but how long records are kept.
The disk requirement consists of two items:
- A 100 GB base — for the operating system, DeepFilter components, databases and email queues.
- An additional minimum of 50 GB for every 10,000 emails per day — to keep one year of logs and traffic records.
Formula: Disk = 100 GB + (daily email count / 10,000) × 50 GB
| Emails per day | Additional log space | Total minimum disk |
|---|---|---|
| 10,000 | 50 GB | 150 GB |
| 50,000 | 250 GB | 350 GB |
| 100,000 | 500 GB | 600 GB |
| 200,000 | 1 TB | 1.1 TB |
The figures in the table are based on a sustained daily average and on the assumption of a one-year retention period. Email that lands in quarantine is not kept indefinitely: by default it is deleted automatically after 30 days. You can change this period from the panel (minimum 1 day; there is no upper limit). If you extend the quarantine retention period, increase the log retention period, or if the volume of email landing in quarantine is high, grow the disk accordingly. Monitor usage regularly, because email reception can stop when the disk fills up.
At high volumes the disk grows faster than you expect. In organizations above 100,000 emails per day, the logs and traffic records alone exceed half a terabyte. Two choices directly affect this calculation: the quarantine retention period (30 days by default) and your log retention preference. Work out the disk impact before extending either; when the disk fills up, email reception can stop.
The recommended minimum disk is 100 GB, while the hard limit at which installation stops is 50 GB. The reason for the gap is this: with 50 GB the installation completes, but the system fills up very quickly. The operating system, the databases, quarantine and the logs consume that space within a few weeks. For this reason a disk below 100 GB is not recommended.
Keeping the disk generous from the start is easier than growing it later. If you are using a virtual disk, setting it up in a form that can be expanded will make your life easier down the line.
Pre-Installation Checklist
- The server was installed with Rocky Linux 9 Minimal, x86_64 (not Workstation or a GUI installation)
- Root access is available
- Total vCPU count is at least 4
- RAM is at least 8 GB (required to take the worker count above 2)
- The disk is sized according to the traffic volume and is at least 100 GB
- The system clock is synchronized
- The DNS resolver is working and firewalld is enabled
- The server has internet access
- There is no other email server or DeepFilter installation on the server
Once the hardware and operating system are ready, move on to the next step for the port and connectivity requirements on the network side.