TechMailYour Mail, Protected by Design
TechMail is built so that the sensitive parts of email - keys, passwords, sessions and delivery - are handled with care from the first migration onward.
Security Baked Into Every Layer
These aren't roadmap promises - they're how TechMail works today.
DKIM keys encrypted at rest
Your domains' DKIM private keys are reversible secrets, so they're sealed with AES-256-GCM before they ever touch the database - never stored in the clear.
Passwords hashed with argon2id
User and mailbox passwords are hashed with argon2id, a memory-hard algorithm designed to resist GPU cracking. Hashes - never plaintext - are stored.
Session tokens are hashed
We store only a SHA-256 hash of each session token. The raw token lives in an httpOnly cookie, so a database read alone can't hijack a session.
Authenticated mail flow
Outbound mail is DKIM-signed; inbound mail is checked for SPF and DKIM. Your domains publish SPF, DKIM and DMARC so receivers can trust what you send.
Standards-compliant servers
TechMail's IMAP (RFC 3501) and POP3 (RFC 1939) servers support STARTTLS / STLS, upgrading plaintext connections to TLS before credentials are exchanged.
You own the perimeter
Because TechMail is self-hosted, your messages and credentials live on infrastructure you operate. There's no third-party SaaS holding your mail.
The Thinking Behind the Design
Two key systems, never mixed
Reversible secrets (like DKIM private keys) use AES-256-GCM via a dedicated SECRET_BOX_KEY. Passwords use one-way argon2id. The two are kept strictly separate.
Least exposure by default
No analytics, no third-party trackers, and no SaaS provider in the core mail path. The data that exists is the data required to run mail - nothing more.
Your responsibility, your control
Self-hosting means the trust boundary is yours. Keep your SECRET_BOX_KEY and database backups safe, apply updates, and you hold the keys to everything.
Security is a shared responsibility
TechMail provides strong defaults - encryption, hashing, authentication and TLS - but a server is only as safe as it is maintained. Your part of the trust boundary:
Keep your host patched
Apply OS and dependency security updates promptly.
Configure your TLS
Terminate HTTPS and STARTTLS with valid certificates.
Protect secrets & backups
Guard your SECRET_BOX_KEY and database backups.