Security
maildigi handles business email, so it is built to keep your messages and your address safe, and to protect the people you write to.
Verified senders
Every incoming message is checked with the standard email authentication methods (SPF, DKIM and DMARC). Messages that fail and whose domain asks for rejection are refused. Messages that look like spam are refused as well.
A reply is accepted only from the personal address registered for your business address, and only when that address’s own email service has signed it. A message that merely claims to come from you is not sent on.
Content is not kept
Messages are processed automatically and passed on straight away. We do not keep a copy of your emails, and nobody reads them. There are only two exceptions, and in both the content is stored encrypted (AES-256-GCM):
- Large attachments: stored for 14 days so that the download links work, then deleted.
- Temporary delivery problems: if the receiving service is briefly unavailable, the message is held for up to 24 hours and delivery is retried. It is deleted once delivered or after 24 hours.
For operation and security we keep a short activity log: time, direction, size and result of each message, without its content. The log is deleted after 30 days.
Secure download links
- Each link contains a long random key that cannot be guessed. We store only a fingerprint of the key, not the key itself.
- Links expire after 14 days.
- Files are offered as downloads and are never opened as web pages.
- Downloading never asks you to sign in or enter a password.
Protection against misuse
- Daily and hourly limits for incoming messages and replies.
- Replies go only to the person who wrote. Cc and Bcc are ignored.
- Automatic replies and mailing-list messages cannot be answered through your business address, which prevents mail loops.
- Loop detection stops messages that circle between addresses.
Responsible sending
maildigi never sends email on its own. It delivers messages that were sent to your business address, and it sends the replies you write. Replies are sent with SPF, DKIM and DMARC set up for your business domain, so receiving services can check that they are genuine.
If you notice misuse, write to abuse@maildigi.com. See also our acceptable use policy.
Want maildigi for your business?
Write to us with your domain name and the personal address you want to use. We will tell you how to get started.