How GINbox protects your email
No vague promises. What each protection does, in plain words — and, wherever it can be seen from outside, how you can check it yourself.
Updated 2 November 2026.
Fake mail in your name is refused
The most common email fraud is a message that pretends to come from you — an invoice with changed bank details, a request from “the director”. Three public DNS records tell the world which mail is really yours, and GINbox sets up all three for every domain you add:
- SPF lists the servers allowed to send for your domain.
- DKIM signs every message you send with a 2048-bit key that only GINbox holds, so a receiver can tell it was not changed on the way. Keys are changed regularly, and a new one is used only once your DNS shows it.
- DMARC tells receivers what to do with mail that fails: junk it or refuse it.
Our own domain shows how it is meant to look. Anyone can read these records:
| Record | What ginbox.net publishes | What it means |
|---|---|---|
| SPF | v=spf1 ip4:65.20.93.242 ip4:65.20.95.208 ~all | Only our two sending addresses may send as ginbox.net |
| DMARC | v=DMARC1; p=quarantine | Mail that pretends to be us goes to junk — not just reported |
| MTA-STS | Published (mode: testing) | Asks senders to use an encrypted connection to reach us; see below |
| TLS reports | v=TLSRPTv1 | Receivers tell us if an encrypted connection to us ever failed |
Check any domain, yours included, with our free email domain checker. More on the three records: SPF, DKIM and DMARC explained.
Encrypted on the way
- Your apps to us: webmail, the phone apps and mail apps such as Outlook and Apple Mail connect only over encrypted connections (TLS).
- Between mail servers: GINbox uses encryption with every server that offers it. We publish an MTA-STS policy, which asks other servers to insist on encryption when they deliver to us. It is in testing mode while we confirm every sender can follow it; then it will be switched to enforce.
- The admin panel requires two-step sign-in for anyone who manages a domain. It cannot be switched off.
Every message is checked
- Spam and phishing are filtered as mail arrives, and published lists of known spam sources are checked.
- Viruses: attachments are scanned when mail arrives and again before mail leaves.
- Dangerous file types that are used to spread malware are refused, with a plain message saying why.
- Payment fraud: an invoice with new bank details from someone pretending to be your supplier is spotted, and you are told in plain words before you pay — see the payment-fraud shield.
Your account stays yours
- Two-step sign-in with an authenticator app; turning it on needs a code sent to your email, so a stolen password alone cannot set it up.
- App passwords for mail apps, so your main password is never stored in a phone or an old computer.
- Stolen-password lock: one mailbox used from more than three networks within an hour is locked from sending, its password replaced, and the domain owner told.
- Sign-in alerts when your account is used from a new country.
- Sending limits per mailbox, so a mistake or a misused account cannot send thousands of messages. Sign-ups are checked too, so our servers are not used to send spam.
Your mail reaches the inbox
Protection is not only about blocking. Your own mail has to arrive:
- Our own sending addresses, with matching names in DNS, used only by GINbox customers whose sign-ups and sending we check.
- Watched around the clock: every few minutes GINbox checks the public block lists and the answers of the large providers. If a provider ever refuses us, mail for it goes out by a backup route automatically, and comes back when the problem is fixed.
- A second sending address for providers that refuse the first.
What the large providers require, from their own pages: Gmail and Outlook rules for business email.
Mail is never lost
- Checked when stored: every message is read back after it is written, so a storage fault is caught at once, not months later.
- Backups that are tested: our database is backed up automatically, with an encrypted copy kept in another country, and restoring it is practised.
- A standby server takes over within minutes if the main one fails. If GINbox were ever briefly unreachable, sending servers keep your mail and try again for days.
- Moving in loses nothing: when you move from another provider, every message is checked against the old server, folder by folder.
Where your data is
| What | Where |
|---|---|
| Our servers, your account and mailbox records, delivery and security records | Mumbai, India |
| The messages in your mailboxes | Singapore, with a storage provider under contract to us |
| The encrypted off-site copy of our database backups | Japan |
| Large files you send as a download link | Bangalore, India |
We plan to move mail storage and backups to India, and will tell you before we do. AI help runs outside India and only when you ask for it. The full details are in our Privacy Policy.
Questions about security
Is GINbox end-to-end encrypted?
No, and we do not claim it. To stop spam, phishing and viruses, our servers have to read incoming mail, which end-to-end encryption would not allow. Your mail is encrypted on every connection we make, and only you and the services you allow can open your mailbox.
Can GINbox staff read my email?
Our systems scan mail automatically for spam and viruses. People at GINbox do not read your mail; access to customer data is limited to what is needed to run the service, as our Privacy Policy describes.
Where is my email stored?
Our servers and your account records are in Mumbai, India. The messages in your mailboxes are stored in Singapore with a storage provider under contract to us. We plan to move mail storage to India and will tell you before we do. The Privacy Policy has the full list.
What happens if someone steals my password?
If one mailbox is used from more than three different networks within an hour, GINbox locks its sending, replaces the password and tells the domain owner, who sends a new setup link. Mail keeps arriving; nothing is lost. Two-step sign-in and app passwords make a stolen password much less useful in the first place.
How do I check my own domain’s protection?
Use our free email domain checker: it reads your domain’s public SPF, DKIM and DMARC records and says in plain words what is missing. GINbox sets these up for your domain when you add it.
Found a security problem? Write to info@ginbox.net — we reply to every report.
Business email that is safe by default
Every protection on this page is in every plan. Try GINbox free for 14 days with up to 3 mailboxes.