Thelemail product changelog.

The export tool is public under AGPL-3.0. It is the third Thelemail component we publish, after the browser client and the key transparency log.

What it does

The tool runs on your own computer. It authenticates with OPAQUE, unlocks the wrapped account key locally and writes each mailbox folder as a standard MBOX file. An interrupted export can be resumed. Nothing is decrypted on our side, because the tool holds the only key that can read the ciphertext we store.

Why it is published

We tell people they can leave with their mail. That promise is worth more when the code behind it can be read, built and audited rather than taken on trust. Publishing the exporter also means the format and the decryption path outlive our involvement.

Mobile client source remains private. The open source page lists what is published, what is not, and how to check that the deployed browser client matches its repository.

This release completes the core administrative path for moving a domain to Thelemail.

Staged DNS connection

The domain wizard now verifies ownership before any mail routing changes. It prepares and checks SPF, DKIM and DMARC, lets the administrator create every mailbox, alias and shared address, then treats MX as the final cutover. The wizard continues monitoring the records after activation so configuration drift is visible.

Unlimited aliases

Paid plans include unlimited aliases across @thelemail.com and connected custom domains. A workspace anti-abuse guardrail may restrict excessive, automated or abusive creation. Aliases are not included in the Free plan. Administrators can create service-specific addresses, role addresses and shared routing without consuming a separate mailbox for every address. Mailbox, storage and domain capacity still follow the selected paid plan.

Spam classification

Inbound external messages are classified for spam during delivery. Readable inbound content is handled in memory, encrypted to the recipient and stored as ciphertext. Stored mailbox content is not scanned for advertising or AI training.

Portable encrypted mail

The export tool now supports accounts protected with OPAQUE. SRP support was removed from the migration surface because new accounts use OPAQUE authentication. Users can export their mailbox in standard formats before moving providers.

These changes support the intended workflow for a household or small team administrator: prepare every recipient, import existing mail, verify the sending configuration and change MX only when the domain is ready.

First commit on the marketing site:

• SvelteKit + Tailwind v4 + shadcn-svelte
• Markdown-driven content via mdsvex
• Initial Cloudflare Pages deployment; the current Contact page now lists direct email addresses