Here you can find information regarding ddmail e-mail system/service.
What is DDMail
DDMail is a e-mail system/service that prioritizes security.
Our definition of privacy
Privacy is when someone knows who you are but doesn't know what you're doing. Privacy is about not disclosing your actions or data. For example your adversary knows that you are using ddmail to send and recive emails but they do not know the content of the emails.
Our definition of anonymity
Anonymity is when someone knows what you're doing but doesn't know who you are. Anonymity is about not disclosing your identity. For example your adversary knows the content of your emails but they do not know that it is you who sends or recives them.
Our definition of security
Security is design, implementation, measures and methods taken to protect you and your data regarding confidentiality, integrity, availability, privacy and anonymity from your adversary.
Privacy and anonymity
We try to protect our users privacy and anonymity. No personal information is needed during registration or usage. We do not track or monitor users activety. We do not serve ads. We do not use javascript. We do not save/log the users ip when using HTTPS or IMAPS. We do not in any way distribute nor sell the small amount of user data we have unless obligated by a court in Sweden. The service is avalible as a tor onion service(before known as tor hidden service). The service is avalible as a i2p service. Using our service including registration, regardless of how you use or access it (clearnet, vpn, tor, i2p) will not require any verification like phone number etc.
Security
We try to use the following design patterns/principle: - less code, less attacksurface - leased privileged - default deny - assume breach The server configuration and application code is all open source and can be reviewed and used by anyone at https://github.com/drzobin. We see all input as evil. We use hard to crack password hashing with argon2. We autoupdate the server software every day. We use mod_security as web application firewall (WAF). We use apparmore as mandatory access control (MAC) in enforce mode. We use apparmore, namespaces and seccomp to sandbox processes. We do not provide any webmail interface nor do our website contains any javascript, images or videos.
Security regarding SMTP and DNS
We are using DNSSEC, SPF, DKIM, DMARC, CAA, MTA-STS and DANE/TLSA(311) to make the service more resilient to threats.
DANE/TLSA
We have DANE/TLSA 311 DNS records for the following services and ports:
SMTP mail.ddmail.se port 25 (with support for STARTTLS)
SMTP mail.ddmail.se port 587 (with support for STARTTLS)
SMTPS mail.ddmail.se port 465 (SMTP wrapped in TLS)
IMAPS mail.ddmail.se port 993 (IMAP wrapped in TLS)
HTTPS ddmail.se port 443 (HTTP wrapped in TLS)
HTTPS www.ddmail.se port 443 (HTTP wrapped in TLS)
Security regarding mail content
We use clamav, oletools with olefy and rspamd to fight malware, phishing and spam.
Default Encryption "at rest"
E-mail is always encrypted "at rest" using elliptic curve secp521r1 private and public key pair. The private key is password protected. The password is the email account password base64 encoded. This encryption/decryption is done seamlessly to the user on ddmail servers. Every email account(maildir) has different key pairs. The password protected private key is stored on ddmail servers.
Extanded Encryption "at rest" using OpenPGP
Incoming emails can be automatic encrypted using OpenPGP public keys. This means that incoming emails will be double encrypted "at rest" where the email accounts (maildir) will be encrypted with "default Encryption at rest" (above-mentioned) and individual emails will also be encrypted with OpenPGP. This is a opt-in feature where the user needs to upload the OpenPGP public key to ddmail servers and activate OpenPGP encryption on specific email account with a specific public key. Using this feature the users OpenPGP private key is not stored on ddmail servers. Encryption is done on ddmail servers but decryption is done on a user controlled device.
Encryption "in transit"
E-mail is encrypted "in transit" as offen as possible using TLS encryption. IMAP and HTTP is always encryptet using TLS 1.2 or TLS 1.3 with strong cipher suites, A+ rating on ssllab. SMTP traffic is encrypted using TLS 1.2 or TLS 1.3 with strong cipher suites when the counter part SMTP server supports it.
Features
Unlimited number of e-mails accounts. Unlimited number of aliases. Unlimited number of own domains. Avalible as Tor Onion Service. Avalible as i2p service. Protocol supported for getting emails is IMAPS(IMAP wrapped in TLS) and protocol supported for sendning email is SMTPS(SMTP wrapped in TLS) or SMTP with STARTTLS.
License
All code and server configuration is open source and licensed under GNU Affero General Public License (AGPL).
Where can i find the code
All development is done in the open using github. The code is located at https://github.com/drzobin.
For how long is backup saved
Backups are saved for 7 days. This means that if you remove you account, account user, email account or alias it takes 7 days before all the data is gone. This also means that when you change any password you need to save the old password for 7 days.
Where is it hosted
The system/service and all its data is hosted in Sweden.
Who is behind this
Run and created by Robin "drz/drzobin" Larsson from Sweden.