How your mail is protected

A mailbox is the reset key to every other account a person owns, which is why this one is built like infrastructure rather than a side project.

Mail you send is authenticated

Every outgoing message is signed with DKIM and the domain publishes SPF and DMARC records that line up with it. Receiving servers can therefore prove the message really came from Mailbirch, which both keeps your mail out of spam folders and stops anyone else sending messages that appear to come from your address. DMARC reports are collected so attempts at forgery are visible.

Mail you receive is filtered first

Incoming messages are scored by rspamd before delivery. Anything that looks like a forged notice, a fake giveaway or a phishing attempt is filed into Junk instead of the inbox, and messages scoring far above the threshold are refused at the SMTP conversation so they never reach disk.

Trackers do not fire

Remote images inside a message are held back until you ask for them — including images referenced from stylesheets, which is a common way of sneaking a tracking pixel past a naive blocker. Until you press “show images”, opening a message tells the sender nothing.

Everything is encrypted in transit

The website is HTTPS only with HSTS. IMAP is offered on 993 with implicit TLS and submission on 465 and 587; the plain-text IMAP port is closed to the internet entirely. TLS 1.2 is the floor everywhere.

Two-factor authentication

Any authenticator application can be paired with an account. Enrolment produces ten single-use recovery codes for the day the phone is lost. Sign-in then asks for a six-digit code, and the password alone is not enough.

Guessing passwords does not work

Five failed sign-ins freeze an account for fifteen minutes. Repeated failures from one address get that address banned at the firewall, and the same protection covers SMTP, IMAP and SSH. Passwords are stored as bcrypt hashes and are never recoverable — not by you, and not by an administrator, who can only reset them.

What is written down about you

Sign-ins, password changes and administrative actions are recorded so that unusual activity is visible, and every account can review its own recent activity. Message contents are never scanned to target advertising. The privacy page lists exactly what is stored and for how long.

What is running

Postfix, Dovecot, rspamd and PostgreSQL on dedicated hardware, with certificates from Let's Encrypt that renew automatically. Advertising on the site runs inside a sandboxed frame served from a different origin, so ad code cannot read your mail or reach the mail API.