DKIM
Every message is signed with your domain's key, so a receiver can prove it really came from you.
The seal
Every message leaves with your name on it.
Delivery is not a setting you hope was configured once. Records are checked continuously and their state is visible inside your admin centre.
SPF
Only our sending hosts are authorised for your domain. Nobody else can send in your name.
DMARC
Alignment enforced with reporting, so spoofing attempts are rejected and visible.
TLS 1.3
Encrypted in transit on modern ciphers, with certificates renewed automatically.
What gets checked, and what it costs you when it breaks
Six records decide whether your company's mail is trusted. We watch all six for you and show the verdict in plain words — not a screenshot of a DNS console.
Record
What it means for you
If it breaks
MX
Mail for your name arrives at our servers, and nowhere else.If it breaks: Incoming mail bounces or silently goes to an old provider.
Incoming mail bounces or silently goes to an old provider.
SPF
Only our sending hosts are allowed to send as you.If it breaks: Receivers start treating your mail as suspicious.
Receivers start treating your mail as suspicious.
DKIM
Each message carries a signature receivers can verify.If it breaks: Your mail can be altered in transit without anyone noticing.
Your mail can be altered in transit without anyone noticing.
DMARC
You tell the world what to do with anything pretending to be you.If it breaks: Anyone can spoof your name at your customers.
Anyone can spoof your name at your customers.
MTA-STS
Receivers refuse to deliver your mail over an unencrypted path.If it breaks: A downgrade attack can read mail in transit.
A downgrade attack can read mail in transit.
TLS-RPT
You get told when someone failed to reach you securely.If it breaks: Encryption failures happen quietly and nobody investigates.
Encryption failures happen quietly and nobody investigates.
Live results for the whole platform are published on the status page.
How we handle your mail
The parts most providers leave to a policy page nobody reads.
Where your mail actually lives
On our own servers in the UK and EU, on encrypted disks, in racks we pay for. Your mail is not resold storage from a hyperscaler with our logo on the invoice.
Who can read it
Nobody. Support does not browse mailboxes, and there is no advertising or profiling system to feed. Any access to your workspace by us requires your written request and lands in your own audit log.
Sessions and devices
Every sign-in records device, location and time. Anything that looks impossible — two countries in ten minutes — is flagged, and you can end any session or device from your own security page in one click.
Backups and retention
Mail is backed up continuously so a lost mailbox is recoverable. When you delete for real, the deletion flows into the backups too — deleted does not mean hidden.
When something breaks
Failures appear on the public status page from the same probes above, not after a customer complains. If mail is affected you get told, with what happened and what changed.
How you leave
One click exports everything in standard formats, on every plan. Security includes the freedom to walk away with your own data intact.