How we protect your mail

Email is often how attackers get in. Here is what Polpo Mail does to keep your messages and accounts safe, and what you can do yourself.

Encryption in transit

• The web app is served only over HTTPS, with HTTP Strict Transport Security.
• IMAP and SMTP submission support TLS (ports 993 and 465) and STARTTLS (ports 143 and 587). Passwords are never accepted over unencrypted connections.
• We offer STARTTLS to every server that delivers mail to us, and use it ourselves when the receiving server supports it.
• You can publish an MTA-STS policy for your domain from the admin console, so other providers refuse to deliver to you without valid TLS. TLS-RPT reports tell you when something goes wrong.

Account protection

• Passwords are stored only as salted bcrypt hashes. We can't see them.
• Two-step verification with passkeys, authenticator apps (TOTP) or a code sent to a backup email, plus one-time recovery codes. Trusted browsers aren't asked again for 30 days.
• Mail apps and integrations never use your account password. They sign in with access tokens limited to what they need (read, send, organise), with an expiry date, and you can revoke each one. A stolen password alone can't open your mailbox over IMAP or SMTP.
• Repeated failed sign-ins are throttled per account and per network, and new-browser sign-ins are reported to your inbox.
• Sessions use secure, HttpOnly, SameSite cookies, and every form is protected against cross-site request forgery.

Authenticated mail

• Every message you send is signed with your domain's own 2048-bit DKIM key, which admins can rotate without downtime.
• Incoming mail is checked with SPF, DKIM and DMARC. Admins choose whether to enforce the sender's DMARC policy, and messages claiming to come from your own domain without authorisation are stopped.
• Spam is scored and moved to Junk, or refused outright when the score is very high.
• HTML email is shown in a sandboxed frame with scripts disabled and remote content restricted.

Platform

• Domains are only activated after their owner proves control through DNS, and each domain can belong to one workspace only.
• Per-connection and per-network limits protect the service from abuse; outgoing mail is rate-limited per user to stop compromised accounts from sending spam.
• Services run as unprivileged processes, and the database is backed up regularly.

What you can do

• Turn on two-step verification in Settings. A passkey is the easiest and strongest option.
• Publish the DMARC record we suggest, and move it to p=quarantine or p=reject once your reports look clean.
• Never share your password. Create a separate access token for each mail app or integration, with only the permissions it needs.

Reporting a vulnerability

If you believe you've found a security issue, please email [email protected] with enough detail for us to reproduce it. We acknowledge reports within three working days and keep you updated until the issue is fixed.

Please act in good faith: only test against accounts you own, don't access or change other people's data, and don't run denial-of-service or spam tests. We won't take legal action against research done this way. Our security.txt follows RFC 9116.

To report spam or abuse sent from Polpo Mail, write to [email protected].