CodaMail

All the power of running your own private mail server without having to do so.

Now celebrating 26 years of service!

One page list of features

Take complete control of your email experience with unbeatable protection

Ever dreamed of blocking emails from entire countries at once? Or just blocking all messages from specific top-level domains like .sbs, .world, or any others cluttering your inbox? Imagine being able to automatically filter messages in languages you don't understand, or selectively disable an email address while still receiving messages from your important contacts.

What if senders received a definitive "User Unknown" rejection at connection, not just silent filtering that hides unwanted mail in folders you never check? And what if accomplishing all this required nothing more than clicking a button? These capabilities represent just a small sample of what our service offers. In fact, if you can envision a solution for managing your email, chances are we've already implemented it.

  • Never worry about email address leaks again: Create unlimited email addresses across 30+ domains, each with its own subdomain catch-all addressing. Give unique real email addresses (not randomly generated aliases) to every service and instantly identify who leaked your email. If spam starts arriving, shut off just that address without affecting any other mail. It's a built in aliasing service on steriods.

    How to categorize your mail while using unique addresses for everything!

  • Instantly stop unwanted messages at the server level: When you block an address or turn off an alias, our system rejects those messages during the SMTP handshake as "User Unknown." Senders believe your address no longer exists, permanently removing you from their lists.

  • Protect your true identity online: Create addresses that can't be linked back to your account, allowing you to segment and categorize your email while enhancing your security. It's like having unlimited email accounts! Your email address no longer needs to be a unique identifier for your online presence!

    An email address getting leaked because some site you gave it to was compromised no longer needs to be a concern!

  • Use your own domains with all our powerful features: Host as many personal domains as you want, each working seamlessly with our complete feature set. Control them as catch-alls or whitelists where only addresses you specify are accepted. Yes, you can even have mail with your own domain rejected at the connection when you block it!

  • Access your secure email from any device: Our webmail works just like an app and will adapt its form factor to whichever device you are using (phone, tablet, or computer). It is compatible with uBlock Origin, DuckDuckGo, Brave, LibreWolf, Firefox, Safari, Edge, Chrome, Mobile Safari, Samsung Internet, and frankly, most modern browsers (mobile and desktop). Our server-side controls mean our features will also work with your preferred email application.

  • Integrate with your existing email setup: You can also integrate our service with your existing mail a number of ways: you can add us to your multiple mailbox app of choice; you can easily forward all mail to your main account after it passes through our features; or you can use us, just like any regular email app, to retrieve via pop or imap (including automatically PGP/GPG encrypting as it is retrieved, if desired) and also send mail using your other account(s) SMTP server with privacy.

Nobody gives you more control of your e-mail than we do!

Need or want to add encryption?

Zero Access & Zero Trust Architecture

  • Your eyes only - truly private storage: You choose whether or not to automatically PGP/GPG encrypt your incoming mail with keys that only you possess, meaning that only you can read your sensitive content. Mailvelope compatible.

  • Encryption your way: Choose what incoming mail gets automatically encrypted and with which public keys, balancing security and convenience. Automatically encrypt all, only specific addresses, or by filter action. Meaning, if you only want to secure your sensitive mail, you can do that. Your mail, your keys, your choice!

  • End-to-end encryption for your most sensitive messages: Easily use standard PGP/GPG with any other user on any other service also using PGP to ensure that only those with the keys can read messages, maintaining privacy from end to end. Standards based means it doesn't just work if you are both on this service, it is service independent.

  • Secure Link: You can select to send a link to an encrypted file instead of an attachment for secure file sharing. Files are encrypted using AES-256-GCM on your device and the encrypted content then is uploaded to our server and a link is put into the email for secure retrieval by the recipient. You will be notified of downloads.

  • Complete data portability and freedom from vendor lock-in: Easily import and export everything (mail, encryption keys, calendars, tasks, address books, and even filters) using standard formats, maintaining full control of your information. Encrypted e-mail is exported fully encrypted, nobody but you can read it in or out of our service (you could export it and post it to the web and you would still be the only one that could read it's content). That is zero access!

  • Built on open standards you can trust: The entire service is built from and runs on widely used standard open source software. Standards matter, You should never be tied to any one service, standards based means easy import and export of any or all data as needed.

Email security based on standards, not promises

Also included: cPanel based Web Hosting, SSH, Socks, and VPN available.
(these operate under our cotse.net domain).
See the full list of features below.

Plans & Prices

How secure is CodaMail?

CodaMail's Security Advantages

CodaMail offers several key security advantages that set it apart from other services:

  • Unparalleled server level control - Our features work at the SMTP handshake level. When you block an address, domain, or top level domain, it is instantly in effect and rejects during the SMTP connection as User Unknown. To the sender it looks like the address doesn't exist. Our servers do not accept the message. The same is true for our catch-all controls.

    We give you protocol level individualized control. There is nobody else that does this. This is why we say that the only way you can get more control over your e-mail is to run your own server...but that may not even be true, we might still offer you better control.
  • True Zero-Access Storage Encryption - CodaMail's PGP(GPG)-based encryption means only you can decrypt your stored messages
  • Flexible Encryption Options - Choose which incoming messages to auto-encrypt and with which keys, rather than just an all-or-nothing single key approach. We only need your public key for this.
  • End-to-End Encryption with PGP/GPG - We give you the ability to use end to end encryption with other PGP users. All our internal mail is end to end encrypted, but even though some services think this is a selling point, it's not. Most services work this way. External mail requires all parties to use compatible encryption.

    We use PGP, for compatibility. We also support Mailvelope, so that even using the webmail, we only need your public key. Your private key should remain on your device. While you can create and manage key pairs with us for ease, your opsec is better if you do it and we only see public keys.
  • Masked Aliases - Create real independent email addresses in over 30 different domains that can't be linked to your main account by external parties. Because you choose the alias name, they don't even look like typical alias services, they look just like real email accounts.
  • Full control of POP and IMAP - POP and IMAP are disabled by default since they don't support TOTP two-factor authentication. However, we strive for compatibility so that you can use your favorite apps with us, so we've made them optional. You can enable them if needed and add even extra security by restricting access through CIDR addressing.
  • Extensive Header Controls - Add, remove, or modify email headers to reduce metadata leakage when using a regular email app. Works with any app at all because it's our SMTP server that is removing, changing, or adding the headers you specify.
  • Open Standards - We use PGP rather than proprietary encryption, ensuring your encrypted data remains encrypted and accessible to you even if you export it outside our system
  • Independent Infrastructure - We maintain our own servers in a cloud that we built and control rather than relying on major cloud providers, reducing exposure to third-party access
  • No external fonts, icons, css, or CDNs - Externally hosted fonts and icons track you! Many sites, webmail packages, skins, calendars, and services use google hosted or other externally hosted fonts, external analytics services, remote content development networks, and externally hosted icons like FontAwesome. These are tracking you and sharing that data! We ensure that everything we offer is hosted on our own servers. We make sure that nothing makes external calls that could compromise privacy!
  • Regular Audits - We utilize widely used open source projects to develop our service, which due to their popularity are very regularly tested by researchers. However, we still regularly audit ourselves. We write our own code with a security first model. We do utilize some open source plugins, which we review and patch as needed. Vulnerabilities we found in open source plugins and patched.
  • Intrusion Detection - We maintain active intrusion detection systems to instantly alert and protect against probes.
  • Bot Protection - We have learned a thing or two about spam bot protection. Our helpdesk email address has been on the web for 25 years and is still usable. We have offered unlimited aliases for 25 years and they are still very usable. We can help you reduce spam.
  • Long Privacy History - We are the longest running privacy service on the Internet, we've consistently maintained our focus on user privacy

We have no investors, no advertising, and no partnerships. Third party partnerships are potential loopholes because you have to also understand their privacy policies. Our loyalty remains with you, your data stays with us.

Easy to use on any device
  • Our webmail works like an app, you don't need to install anything
  • Support for desktop, tablet, and phone
  • Protection from tracking pixels, remote images, and scripts
  • Built in XSS protection
  • Long press, right click, and drag and drop functions
Easily import or export everything!

We made sure that everything is easy to import and export using popular universal formats. Easily import and export mail, encryption keys, calendars, tasks, address books, even your sieve filters. Your exported PGP encrypted mail still remains PGP encrypted, not even the encryption is tied to our service. We fully believe you should be able to migrate everything easily in and out as needed.

Masked Aliases
  • Masked aliases are like having different email accounts, all with unlimited aliases.
  • We currently offer over 30 different domains to choose from for your masked aliases.
  • Create custom root level aliases in any domain we offer. ie. alias@domain.com (you choose what you want for alias) and you'll also get the catch-all of anything@alias.domain.com
  • Masked aliases do not show your account name in any way and you cannot log in as any of your masked aliases. This protects you from email address leaks.
  • Masked aliases give you the power to segment your e-mail.
How to categorize your email while using unique addresses for everything.

Catch-all addressing allows subscribers to receive emails sent to any address at their domain, even if the specific address has not been set up. Users can create unlimited unique addresses for different purposes, enhancing organization and spam control.

Account Based Aliases
  • Account aliases is like having your account name at 30 different domains, each with unlimited aliases.
  • You'll be able to activate youraccount@any_domain_we_offer.
  • These do not count as masked aliases.
  • Activation includes catch all.
Understanding Account Aliases vs Masked Aliases
Unlimited Hosted Domains
  • Host your own domain(s) with us, as many as you'd like
  • Unlimited aliases in your own domain(s)
  • Disable or enable catch-all
  • Turn a catch-all into a white list with the click of a switch
  • Disable individual aliases
  • Disabled aliases are rejected during the SMTP handshake as User unknown
  • All of your own domain aliases work with all features
Full smtp-level control of all
  • Disable or enable catch-all
  • Turn a catch-all into a white list with the click of a switch
  • Enable or disable over 30 domains at will
  • Disable individual alias(es)
  • Block From addresses, domains, and top level domains
  • All rejected mail is rejected during the SMTP handshake as User unknown

Catch-all addressing allows subscribers to receive emails sent to any address at their chosen domains, even if the specific address has not been set up. Users can can give out custom unlimited unique addresses on the fly for different purposes, enhancing organization and spam control.

We give you over 30 domains for use with catch-alls. Enable one or any number. Plus we give you masked aliases, and they have catch-alls too. You can host your own domain(s) with us also as a catch-all, working with all our features just as our offered domains do.

Truly unlimited aliases. You have full control of all catch-all addressing, too. You can chose to reject aliases you list or you can click a switch and it will only accept aliases you list. you can list just the alias, which will be applied to all your selected and hosted domains, or you can list the full email, for more granular control. Rejections are handled during the SMTP handshake as User Unkown

Is your domain getting killed by spam?

We can help!

Our helpdesk email address has been on the web for 25 years. We have been offering unlimited aliases for the same amount of time. We have learned a thing or two. We can save your domain and make it usable again, even as a catch-all! Try hosting your domain with us and see the difference!

Click here for details of our unique anti-spam solutions

At-Rest Encryption
  • All mail is individually encrypted using elliptic-curve AES-GCM-256 prior to storage, all headers included. All mail sent Codamail to Codamail is fully encrypted, the same elliptic-curve AES-GCM-256, including all headers. Outside mail is encrypted upon receipt. Mail is only decrypted when you read it. This is all transparent to you, no matter what e-mail client you use.
  • Note: The server holds the key for this, so this type of encryption isn't zero access, even though some services claim it as such. See Zero Access Encryption below for true Zero Access stored email.
Zero Access for Stored Messages
  • Auto-encrypt all incoming mail with one master public PGP key or
  • Only Auto-encrypt specific aliases with their own public PGP keys or
  • Auto-encrypt with a filter action based on anything in the message with your choice of PGP key
    • An example could be a filter that auto-encrypts any mail where the subject line begins with the word Encrypt.
  • Automatic PGP encryption is not tied to your account or login password. You create the key, you own the key, you control the key. This means you can move your email anywhere still encrypted and read it elsewhere with your private key. Even your encrypted email is not tied to this service, as easily exportable as the rest.
  • You have full control. Your choice, your keys, your mail.
Zero Trust with PGP
  • Communicate with others using PGP for end-to-end encryption, which ensures that only you and who you are communicating with can read these messages.
  • Sign or encrypt mail
  • Store your private keys on the server with a strong passphrase for ease or keep them on your local device for security
  • Mailvelope compatible or use your favorite email app
  • This is the way for true Zero Access in transit and not just zero access storage

Note: If you store your private keys on our server, first use a very strong pass phrase, but, mainly, you are breaking the zero trust architecture and trusting us with your key. True end-to-end encryption means you should store your own private keys.

Secure File Sharing

Send large files securely without cluttering inboxes or hitting email attachment limits. Our encrypted file sharing feature automatically encrypts on your device with AES-256-GCM encryption before being stored on our servers.

Instead of attaching files directly to emails, recipients receive a secure download link (you must share the password with them, preferably via some other method than the same e-mail that contains the link for security).

Files are automatically deleted after 24 hours, and senders receive notifications when files are downloaded. Perfect for sharing sensitive documents or any content that requires an extra layer of security and privacy.

This uses the WebCrypto API that is available in most modern browsers to perform the encryption client-side. Your browser must support this for this feature to work.

Schedule messages to send at a future date

Schedule anything that can be sent in a mail (plain text, pgp, formatted text, attachments, etc) to be sent at a specific date and time in the future. Automatically detects if the identity has a custom SMTP server and will use the proper server and credentials for that identity.

Calendar, Tasks, and Notes Integration

Calendar Features

  • Multiple calendar support: Create and manage different calendars for personal, work, and shared use.
  • Comprehensive event management with customizable details and recurrence options.
  • Create calendar events directly from any email.
  • Reminders and notifications for upcoming events.
  • Free/busy time indication to show your availability.
  • Send and receive event invitations with RSVP options.
  • Support for iCalendar format (.ics) import/export.
  • Multiple views: day, week, month, and agenda list.
  • Attachment support for calendar events.
  • Mobile-friendly interface for access anywhere.
  • Easily import and export calendars in .ics format.

Tasks Features

  • Create and organize tasks with multiple task lists
  • Create tasks directly from any e-mail, including attachments.
  • Set due dates, start dates, and priority levels
  • Track completion status and progress
  • Recurring task options for regular responsibilities
  • Tag and categorize tasks for easy filtering
  • Customizable reminders for upcoming or overdue tasks
  • Task sharing and delegation capabilities
  • Create tasks directly from emails
  • Search and filter tasks by various criteria
  • Seamless integration with your email workflow
  • Easily export and import task lists in .ics format

Notes Features

  • Upload, Download, Create, Delete, Edit, and Send functionality
  • Create and edit notes in plain text, html, or markdown
  • Upload text, images, pdfs, and more as Notes
  • Easily download any Note
  • Easily send Notes (including images and pdfs) as attachments
  • Search your Notes
Fetch E-mail
  • Retrieve your email from any other service.
  • Reply as normal and our service will automatically select the proper from address.
  • Auto-encrypt it with your choice of public PGP key
  • Filter it into it's own folders
  • Leave or delete it after retrieval
  • All filters work on fetched mail
  • Automatically send via the retrieved services' smtp server for proper spf/dkim/dmarc
  • Your ip address is kept private from the service you retrieve and send through, and your receiver cannot tell you are using this service, to them it looks like you are directly using the remote account
  • Work with all of your mail accounts in one place.
Advanced Mail Filters
  • Full control of sieve mail filters
  • Anything you can think of that you might want to do with mail when it arrives, there is a way.
  • Forward mail by filter action
  • Filter to folders
  • Modify headers
  • Set or remove flags
  • Reject, discard, or delete
  • Set up auto-replies
  • Set up timed out of office replies
  • Add PGP encryption with your choice of public PGP key to any filter
Antispam and Antivirus Tools

Click here for details of our unique anti-spam solutions

  • Easily block from addresses or domains (including just top level domains). Rejections occur during SMTP handshake.
  • Auto learning filters. Just by marking messages Junk you train your spam filters.
  • We give you full control of SpamAssassin, the number one open source antispam solution.
  • DNS based filters. Use popular DNS Block lists.
  • Custom filters. Create your own custom spam rules.
  • Antivirus by ClamAV, the number one open source antivirus package.
Control imap and pop
  • Enable pop or imap for use with your favorite email app.
  • Restrict pop and/or imap access to specific IP addresses or CIDR subnets for added security.
  • All services encrypted
  • All with Perfect Forward Secrecy
  • SMTP automatically removes identifying headers from your mail client
Other advanced mail features
  • Add, remove, or change headers on your outgoing e-mail to assist in obscuring whatever e-mail client you are using.
  • We remove the following headers from incoming mail for your privacy:
    • X-Confirm-Reading-To
    • Disposition-Notification-To
    • Return-Receipt-To
    • X-Read-Receipt-To
    • X-Delivery-Notification-To
    • X-MS-Read-Receipt
    • X-MS-Return-Receipt
    • Receipt-Requested-To
  • Easily forward all mail to your existing email account, effectively using our features with your e-mail.
  • Available Two Factor TOTP Authentication
  • Support for spf, dkim, and dmarc
  • Easy to configure Out of Office Autoreplies
  • Save responses for quick replies.
  • Archive your mail by year or month.
  • Remove any or all attachments from an e-mail.
  • Built in PDF and ODF viewers that also enable you to add text, images, draw on, and highlight with most modern browsers, desktop and mobile.
cPanel based Web Hosting
  • Professional web hosting with the industry-standard cPanel control panel, giving you an intuitive interface to manage your websites, databases, and web applications
  • Full suite of features including PHP support, MySQL databases, FTP access, SSL certificates, and website statistics
  • Easy one-click installers for popular platforms like WordPress, Drupal, and Joomla
  • Comprehensive file management, backup tools, and security features
  • Included in our most popular service plans at a fraction of typical web hosting costs
SSH Tunneling
  • Create encrypted connections through our secure servers, perfect for bypassing network restrictions while maintaining high security
  • Multiple tunneling options: direct tunneling for speed, pass-through proxy for additional routing, or privacy proxy for enhanced anonymity
  • Excellent alternative to VPNs in restrictive environments, as SSH traffic is often less scrutinized
  • All traffic is fully encrypted and can be configured to work with specific applications or your entire system
  • Proxies are offered here, but only accessible under our cotse.net domain.
Socks Proxy
  • High-speed SOCKS5 proxy service that supports both authentication and DNS resolution
  • Perfect for applications that don't support VPN connections or when you need protocol-specific privacy
  • Can be used as a VPN endpoint to mask VPN usage in restrictive environments
  • Compatible with most applications that support proxy connections, including web browsers, chat clients, and email applications
  • Proxies are offered here, but only accessible under our cotse.net domain.
VPN Services
  • Secure, high-speed VPN service with servers strategically located across multiple countries
  • Utilizes OpenVPN protocol for robust security and proven reliability
  • No logging policy to protect your privacy, with perfect forward secrecy and strong encryption
  • Compatible with all major operating systems and devices, including Windows, macOS, Linux, iOS, and Android
  • Available as a standalone service or as an add-on to any of our subscription plans
  • Proxies are offered here, but only accessible under our cotse.net domain.
Test us using trusted online tests