CUBE Mail · sealed mail hosting
CUBE Mail is mail hosting with the design of the sealed store behind it. Delivery is plain IMAP and SMTP over TLS for any client; the mail volume is a LUKS-encrypted disk whose passphrase is sealed inside the CUBE store, and it refuses to mount for postfix and dovecot until someone opens it. Switch on the sealed relay from inside CUBED-mail or CUBE-Contact and the server stops holding a readable message body for that address at all — the key exists only in the app.
The mail volume is one LUKS-encrypted disk on our server. Its passphrase is sealed in the CUBE store; the volume does not mount for the mail agents until it is opened. A copy of the disk alone is unreadable.
IMAP 993 and SMTP 587 with STARTTLS for any client — Thunderbird, Apple Mail, a phone, or our own apps. The sealed relay is the optional extra: bodies arrive encrypted to a key that exists only inside CUBED-mail or CUBE-Contact.
TLS 1.2 and 1.3 only. MTA-STS is published for every MX we host, so a downgrade attack against our MX is refused, and TLS-RPT reports land in a mailbox we read daily.
We do not profile your mail, sell it, or count opens with tracking pixels. There is no ad tier and no cloud identity required to use the mailbox.
Standard. The mailbox is a normal IMAP/SMTP account on our server: any client, any device, with TLS on every port and the disk sealed at rest. The server has to see a message in the clear while it delivers it — that is how every hosted inbox works.
Sealed relay. From inside CUBED-mail or CUBE-Contact you switch the relay on for the account, and the server stores ciphertext bodies from then on — an envelope with the sender, subject and size, and a blob only your app opens. The private key never leaves the app. It is opt-in, per account, off by default.
MX for your domain, up to 5 mailboxes, 2GB total, catch-all included, sealed at rest. One domain per US$5; each additional domain is another US$5 a month.
See the pricing page → — ordering takes your domain at checkout, and the mailbox (with catch-all) is provisioned automatically the moment payment clears.
Included in the app: turns sealing on for an address without changing its mailbox, password or client. CUBED-mail is free; CUBE-Contact runs a 30-day trial, then US$19 a year. There is nothing to buy for the relay — it is part of what the app does. Optional: with it off, that mailbox is an ordinary sealed-at-rest one.