Security built in.
Zyroxi combines modern email authentication, protected connections and practical account controls. Here is what protects your mail, layer by layer.
How your mail is protected.
Encrypted connections
Webmail, the admin portal and mail apps all connect over TLS.
- Webmail and the admin portal load only over HTTPS; plain HTTP is redirected.
- Mail apps connect over TLS: IMAP on port 993, SMTP on 465, or on 587 with STARTTLS.
- Mail between Zyroxi and other mail servers is encrypted whenever the other server supports TLS.
- Zyroxi's own domain is signed with DNSSEC, and only named certificate authorities may issue its certificates.
- Zyroxi's own domain also enforces MTA-STS, so mail to zyroxi.com addresses must arrive over a verified TLS connection.
Your domain's authentication
The portal gives you the exact DNS records that let receiving servers check that mail really came from you.
- SPF names Zyroxi's servers and marks every other sender as a fail.
- Every message is signed twice with DKIM, with an Ed25519 key and an RSA key, so both modern and older receivers can verify it.
- DMARC starts in monitoring mode, and the reports receiving servers send about your domain come to Zyroxi.
- Once everything you send passes, you can tighten DMARC to quarantine or reject.
Accounts and access
Sign-in protection for everyone on your account, and servers kept out of reach.
- Everyone who signs in to the admin portal can turn on two-factor authentication with an authenticator app, and gets recovery codes in case a phone is lost. It is optional, and we recommend it, because this login can manage your mailboxes.
- Mailbox users can turn on two-factor sign-in for their own mailbox and create app passwords for their mail apps, in webmail under Settings → Security.
- Each admin is invited separately, with their own password, and can be removed on their own.
- An admin can reset any mailbox's password from the portal straight away.
- The administration panels of the mail server and webmail are not reachable from the public internet.
- Payments go through Kashier's secure checkout; card details never touch Zyroxi's servers.
Spam, malware and abuse
Filtering on the way in, limits on the way out.
- Incoming mail is scanned for spam and malware before it reaches your inboxes.
- Every mailbox has hourly and daily sending limits, so one stolen password cannot flood the sending address all customers share.
- We are alerted when a mailbox hits its limit or outgoing mail starts to queue.
- Our sending reputation is registered with Google Postmaster Tools and Microsoft's SNDS and JMRP feedback programmes.
- Abuse reports have a working abuse@zyroxi.com address, as mail standards require.
Backups and recovery
Copies kept in more than one place, and checked.
- Mail is backed up every night.
- A second copy is kept with a different storage company, in a different country from our servers.
- Database backups are encrypted with AES-256 before they leave the server.
- Stored mail is versioned, so earlier copies of changed or deleted data are kept for at least 90 days.
- Restores have been tested: the mail database was rebuilt from backup and checked against the live system.
Meetings
Zyroxi Meet runs on Zyroxi's own servers, not a third-party meeting service.
- Calls are encrypted in transit.
- Only people with a Zyroxi mailbox can start a meeting; guests can only join one.
- A meeting link grants no host rights on its own, so it is safe to forward.
Security questions.
Is two-factor authentication required?
No, it is optional, and we recommend it. Anyone who signs in to the admin portal can turn it on from their profile menu with an authenticator app, and gets recovery codes. Mailbox users can turn it on in webmail under Settings → Security, where they can also create app passwords for mail apps.
Is my mail encrypted?
In transit, yes: webmail, the admin portal and mail apps connect to Zyroxi over TLS, and mail between Zyroxi and other mail servers is encrypted whenever the other server supports it.
Why does my domain's DMARC start in monitoring mode?
So that mail you legitimately send through other services, such as a newsletter tool or a form on your website, is not blocked while you confirm that everything passes. The reports for your domain come to us, so ask support before you tighten it to quarantine or reject.
Where are backups kept?
With two separate storage companies. The main copy is updated every night, and a second copy is kept in a different country from our servers. Database backups are encrypted with AES-256.
What happens if someone steals a mailbox password?
Sending limits stop a stolen mailbox from sending in bulk, and we are alerted when a mailbox hits them. An admin can reset the password from the portal straight away.
How can I see if a service is down?
The Help page shows live status for webmail, mail apps, sending, the admin portal and Meet, updated about once a minute.
How do I report a security problem?
Contact us through the contact page and say it is a security issue. To report spam or abuse from a Zyroxi address, write to abuse@zyroxi.com.