Security

Passwords are verified against our own servers (scrypt-hashed) and never stored in plain text. You can turn on two-factor authentication (TOTP, works with any authenticator app) with single-use recovery codes. Each mail client uses its own device password that you can revoke individually, so your main password never leaves the web app. Every active session is listed and revocable, and you can sign out everywhere at once.

In transit: TLS on every connection. IMAP (993), POP3 (995), submission (465), the web app (HTTPS), and server-to-server SMTP where the other side supports it. We publish TLS-RPT, so sending servers can report TLS failures to us. See transport security below for what we do and don’t yet claim there.

At rest: mail is stored on encrypted volumes with per-account isolation. Stored device credentials are encrypted with AES-256-GCM.

Honest limit: MailHow is not end-to-end encrypted. Like all standard IMAP mail, the server can technically access message content to deliver and index it. We don’t read it (see the privacy policy), but if you need cryptographic guarantees that no server can, use PGP on top or a dedicated end-to-end service.

Every domain you connect is set up with dual DKIM signatures (modern ed25519 + classic RSA), a strict SPF record, and DMARC. So receivers can verify your mail is genuinely from you, and spoofers can’t forge your domain. We monitor the sending IP against major blocklists daily.

Mail and account data are backed up nightly (7 daily + 4 weekly snapshots), with independent encrypted off-site copies and restore drills that run on a schedule and are recorded. A drill that happened once, by hand, is a hope with a date on it. Because MailHow speaks standard IMAP, you can always keep your own copy. Drag folders in Apple Mail or use any IMAP backup tool. Your mail is never locked in. More on durability, exports, and what happens if we disappear: Trust & reliability.

When a message can’t be delivered right away, the far end is down, greylisting you, or you’ve gone over an hourly limit, it is deferred and retried, not discarded. A deferred message keeps trying and gets through; a dropped one is simply gone, and the sender never finds out. If a message finally can’t be delivered, you get a bounce that says why.

The same rule applies to us: our operators can see the outbound queue and retry a stuck message, but there is no path that quietly deletes your mail to make a graph look better. Rate limits defer; they never bounce. That is written down on the limits page too, because it’s the kind of promise that should be findable.

Mail to and from MailHow travels over TLS wherever the other side supports it, which today is nearly everywhere. We publish TLS-RPT, so other providers send us machine-readable reports when a TLS connection to us fails. Which is how you find out about a problem instead of guessing.

We are not yet claiming MTA-STS enforcement, because claiming a control you haven’t finished is how security pages become fiction. When our policy is served and has had a clean reporting period, this paragraph will say so, and say which mode it’s in.

Hosted in the EU. Connection and delivery logs are kept at most 30 days, only for abuse prevention and debugging. No third-party trackers on this site or in the app, no ads, and we don’t train AI models on your mail.

Found a security issue? Email security@mailhow.com. We’ll acknowledge quickly and work with you in good faith. No legal action for good-faith research. Machine-readable details: security.txt.