Thelemail
Sign in Create free mailbox
Home / How it works

How your mail moves through Thelemail.

From your first mailbox to the moment a message arrives. What happens on your device, what our servers handle, and where encryption begins and ends.

Follow a message Bring your existing mail
Your mailbox

Start with an address. Make it yours.

An @thelemail.com mailbox works on its own. You can connect a domain you own whenever you are ready.

  1. Create your account

    Your password unlocks your mailbox on your device. We never receive the password.

  2. Save a way back in

    Open Security settings and save your recovery phrase. Keep it somewhere safe so you can recover access if you forget your password.

  3. Write your first message

    Open your mailbox, choose a recipient and send. The protection along the way depends on where that message is going.

A message in motion

The recipient changes the route.

Encrypted storage and end-to-end encryption protect different parts of the journey. Here is what that means for the mail you send and receive.

Between Thelemail accounts

End-to-end encrypted

Your device encrypts the message body, subject and attachments before sending. The recipient’s device decrypts them. Thelemail carries and stores that content as ciphertext.

What remains visible Routing information, including sender and recipient addresses, is still visible to the service.

With a compatible external mailbox

OpenPGP when available

For outgoing mail, Thelemail can find a compatible recipient key through WKD/OpenPGP and encrypt the content on your device. External senders can also encrypt to your published key. Both directions depend on the sender using compatible encryption.

What remains visible External subject headers and routing information remain visible. A message from another provider is not automatically end-to-end encrypted.

With an ordinary external mailbox

Encrypted storage · standard email delivery

Incoming mail reaches our mail gateway in readable form before it is encrypted for your mailbox. For outgoing mail, the gateway processes readable content for delivery to the recipient’s provider. Server connections use TLS where supported.

What remains visible The gateway and the external provider can read the content during processing. Encryption in your stored mailbox does not make this route end-to-end encrypted.

For the full boundaries, including metadata, device security and trust in the service, read our security and threat model.

The handoff

We operate the delivery. The receiving server has a say.

Thelemail runs the mail infrastructure and manages sending reputation. Delivery to another provider still depends on that provider’s policies.

Authenticate the sender

SPF, DKIM and DMARC help receiving providers verify that mail is authorized to come from your domain. The domain wizard guides you through those records.

Hand mail to the next server

We handle sending infrastructure and monitor reputation. The recipient’s provider decides whether to accept the message and where to place it.

Know what acceptance means

Acceptance by a receiving server does not guarantee inbox placement or mean the recipient has read your message.

Bring your mail

Your domain can move in stages.

Keep your current provider receiving mail while you prepare Thelemail. Change the incoming-mail route after the addresses and sending records are ready.

  1. Verify the domain you own

    Add the ownership record from the setup wizard. Your existing provider keeps receiving incoming mail.

  2. Prepare sending and recipients

    Set up the sending records, then create the mailboxes and aliases that need to receive mail.

  3. Bring your existing messages

    Import existing messages as .eml files. Thelemail encrypts them on your device before uploading them. Check the imported messages in your inbox before switching delivery.

  4. Change MX when you are ready

    Update the DNS records that direct incoming mail. Keep the old provider available during the transition: some senders may still use the previous records until their caches update.

Staying in control

Reading, recovering and leaving.

Where do I read my mail?

Use the Thelemail web app or the open-source macOS desktop app. Standard IMAP/SMTP access for clients such as Apple Mail or Thunderbird is not currently available. Thelemail does not currently offer a local bridge for those clients.

What if I forget my password?

Save your recovery phrase in Security settings while you have access. If you lose both your password and your recovery phrase, we cannot decrypt your stored mail for you.

Can I take my mail with me?

Yes. The public export tool runs on your computer and exports mailbox folders as standard MBOX files. It is a command-line tool, with instructions in its repository. If you own your domain, you can move incoming delivery to another provider by changing its MX records.

Export tool and instructions

Fay ce que vouldras. The only rule of the Abbey of Thélème. Rabelais, Gargantua, 1534.

We wrote down what we can't protect.

The threat model spells out what is encrypted, what is not, and what a server compromise would and would not expose. The gaps we haven't closed yet are listed with it.

Create free mailbox Read the threat model