Security & deliverability

Authentication that receivers respect

Every domain we host gets three DNS records that tell receiving servers your mail is genuine:

Misconfigured or missing records are the usual reason small-business mail lands in spam. We configure and verify all three correctly from day one.

Encryption in transit

Webmail, IMAP and mail submission (the connection your mail app or webmail uses to send) are TLS-encrypted, and plaintext logins are not accepted. Mail delivered onward to other providers uses TLS when the receiving server supports it — true for the large majority of mail today, though it isn't something any sender can guarantee for every recipient on the internet.

Spam and abuse handling

Incoming mail passes through rspamd, the open-source spam-filtering engine, plus IP and domain blocklists, before it reaches your inbox. Suspected spam is quarantined, not silently dropped. Outgoing mail is rate-limited per mailbox, which bounds how much a compromised account can send. Mail for every hosted domain leaves from a single shared outbound IP, so abuse from one account can affect delivery for everyone else here. Accounts that send spam or bulk mail will be suspended.

Your data

Your mail is not scanned for advertising, profiling or training. It's stored on a single server, encrypted at rest, though the key is held on the same server, so the operator retains technical access for support and troubleshooting — we're a small, personally-run service, not a company with a data-access policy layered between you and your mail. Backups run nightly and are kept for seven days; a restore was last verified on 2026-08-18, checking recovered messages byte-for-byte against the live mailbox. They are written to the same server that holds the mail, so they cover deletion, corruption and a bad upgrade — not loss of the host itself. When you leave, your mail exports over IMAP and is deleted on request. Full detail in the privacy policy.