--- title: "Email security on your own domain - OpenEmail" description: "Publish the records that prove your mail is yours, and give your team an inbox that scores what arrives and names the look-alike domains" url: "https://openemail.uk/use-cases/email-security" --- Mail you can trust # Keep your domain yours and your inbox honest Publish the records that prove your mail is yours. Every message that arrives comes scored, with the sender checks and the reasons on it. [Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[All use cases](https://openemail.uk/use-cases.md) acme.com yourdomain.com Records found TXT @ Ownership CNAME oe1.\_domainkey Signing TXT \_dmarc Policy MX @ Routing Starter policy v=DMARC1; p=none Copy each record into your DNS. The domain verifies once all of them are found. Where it starts ## What this looks like today. Nothing stops mail sent as you Your domain publishes no policy, so a forgery and a real invoice arrive looking the same. A look-alike got through One letter was different in the sending domain, and the person who read it had no way to tell. Senders learn when you opened it An invisible image loads as the message is drawn and reports the moment back to whoever sent it. How it works ## Running in four steps. 1. 01 Add your domain Add it in Settings, Domains, and ownership, signing and routing records are generated with a starter policy. 2. 02 Publish the records Paste them at your DNS host, or sync them in one press where that host is supported. 3. 03 Read the verdict, then block Four tiles score every message, so open one for the reasons and block one address or a whole domain. 4. 04 Set the roles and two-factor An invitation carries the role and the addresses, and anyone without two-factor meets a lockout. What it runs on ## The parts doing the work. The parts this runs on: what your domain publishes, what happens to a message on arrival, and what a reader gives away by opening one. DMARC policy A starter p=none record, printed to copy or written by a sync, never tightened for you. TXT \_dmarc.acme.com v=DMARC1; p= none; rua=… Optional watch only Verified sender A mark beside the sender when the sending domain’s published records line up. receipts@ stripe.com SPF DKIM DMARC verified sender Phishing & spam filtering Mail the sending domain itself disowns lands in Spam rather than the inbox. receipts@ stripe.com SPF DKIM DMARC verified sender Block a sender or a domain One address, or everything from a domain, stopped before it reaches you. deals@spammy.io blocked sender anyone@spammy.io blocked domain hr@recruit.co language filter ci@acme.dev your rule → archive Bad-language filter Mail carrying the words you do not want to read does not open in front of you. deals@spammy.io blocked sender anyone@spammy.io blocked domain hr@recruit.co language filter ci@acme.dev your rule → archive Account security A code from your authenticator app, on top of your password. Transport encryption Mail moves over TLS on the hops we run, and transport alone never turns the padlock green, because nothing on this backend can read the transport off a delivery. readable where it lands Wire transfer approved, details attached. you tls openemail.uk starttls? them Encryption at rest Soon Every field of a message sealed before it is written down (body, subject, addresses and attachment bytes), so a copy of the database is ciphertext rather than mail. readable where it lands Wire transfer approved, details attached. you tls openemail.uk starttls? them Tracking pixels stripped The invisible image that tells a sender you opened their mail is gone before you see the message. tracking pixel stripped hidden preheader stripped remote image stripped 0 left to phone home Remote image control Stop a sender fetching anything from their own server while you read. tracking pixel stripped hidden preheader stripped remote image stripped 0 left to phone home In practice ## Every piece, walked through. Four shorter pages, each a single job inside it: the domain records, the verdict on a message, who may read what, and reading without being counted. Lock down your domain Publish the records that prove your mail is yours, and check what your domain says in public. yourdomain.com Records found TXT @ CNAME oe1.\_domainkey TXT \_dmarc MX @ Catch phishing mail Every message arrives scored, with the sender checks, the reasons and the look-alike domain named on it. Ridgeline billing@ridge line.com Verified sender Sender Safety Privacy Writing Sender checks passed. Control who reads what A role says what someone may do. A grant says which addresses they may do it to. MK Mara Kell Member Mail Organising Domains Keys support @acme.com Can send hello @acme.com Can send Read without being tracked Tracking pixels come out before a message is drawn, and remote images load only when you allow them. Images are off Show images Requests to sender 0 Questions ## Asked before signing up. Will this stop someone sending as our domain? Only partly. OpenEmail generates the ownership, signing and routing records and a starter DMARC record at p=none, which asks for nothing to be rejected. Tightening it is your decision at your DNS host. What does the verdict on a message check? Sender authentication, links, attachments, wording and look-alike domains. The result is four tiles on the message: sender, safety, privacy and writing. Open one to read the reasons behind it. Is our mail encrypted where it is stored? Not yet. Mail moves over TLS on the hops OpenEmail runs, and the credentials you hand over are sealed, but message bodies, subjects and attachments are stored as they arrived. Nearby ## Other jobs for the same mailbox. Put the whole company Addresses for people and for roles, all on one domain. Each has its own people, keeps the shared sign-off, and stays put when somebody leaves. DNS records Verified MX @ TXT @ ben@ acme.com BW anna@ acme.com AL Email that outlives Your domain, an address you invent for each signup, and nothing reporting back when you read. Change provider later and the addresses come with the domain. 2015 jd\_1994@freemail.example 2019 j.doe@firstjob.example me@ myname.com Take on clients Each client gets a workspace of their own: their domains, their addresses, their people. You switch between them at the top of the sidebar, and nothing crosses over. NR HV PL BC northroad.com hello@ @northroad.com billing@ @northroad.com AB KM 6 filters [All use cases](https://openemail.uk/use-cases.md)