Encryption everywhere
TLS in transit for every connection — dashboard, webmail, API and mail clients — and mail encrypted at rest on our servers.
Two-factor authentication
Dashboard accounts support 2FA and keep a login history you can review.
Granular team roles
Owner, Admin, Developer and Viewer, so billing and deletion stay locked to who needs them.
Full audit trail
Every administrative action recorded, timestamped and attributed — nothing happens quietly.
IP allowlisting
Restrict SMTP credentials and API keys to specific network ranges, so a leaked key is useless off your network.
Open-source core
The mail server and webmail are AGPL-3.0 — every security-critical line is public and auditable.
Email authentication
Strong sender authentication is the foundation of deliverability and protection against spoofing. Mailyte configures the three core standards for every domain you verify:
- SPF (Sender Policy Framework) — declares which servers are authorised to send mail for your domain.
- DKIM (DomainKeys Identified Mail) — cryptographically signs your messages so receivers can verify they were not altered in transit.
- DMARC (Domain-based Message Authentication, Reporting & Conformance) — tells receiving servers how to handle messages that fail authentication.
We generate the exact DNS records you need and verify them against live DNS during domain setup — a record shows as verified only when it actually resolves. Sender identity is also enforced on our submission ports: authenticated users can only send as addresses they own.
Encryption
Connections to the Mailyte dashboard, webmail, and APIs are encrypted in transit with TLS, and mail clients connect over TLS on the standard secure ports. Mailbox credentials, SMTP passwords, and other sensitive data are encrypted at rest, and stored mail on our servers is encrypted at rest as well. We use opportunistic TLS for outbound mail wherever the receiving server supports it.
Access control
- Dashboard accounts support two-factor authentication and keep a login history you can review.
- Team access is role-based — Owner, Admin, Developer, and Viewer — so each member gets exactly the access they need.
- API keys and SMTP credentials are scoped, can be restricted to specific IP ranges, and are revocable immediately. Webhook payloads are signed so you can verify they came from us.
- Webmail sessions are tied to each mailbox’s own credentials — administrators manage mailboxes, but sign-in always verifies against the mail server itself.
- Every administrative action is recorded in an audit trail.
Content & data handling
- Email logs retain full message content for 30 days to power search and troubleshooting — and attachments are never stored in logs.
- Suppression lists prevent repeat sends to addresses that bounced or unsubscribed.
- Migration runs read-only against your old provider — source mailboxes are never modified.
Operational practices
- The mail server and webmail are open source — transparency you can audit, not security through obscurity.
- Inbound spam and phishing filtering on every hosted mailbox.
- Continuous monitoring of delivery rates, bounces, and sending reputation.
- Rate limiting and abuse prevention to protect shared infrastructure.
- Regular dependency updates and security patching.
Reporting a vulnerability
If you believe you have found a security issue, we want to hear from you. Please email security@mailyte.com with the details so we can investigate and respond promptly.