Learn
Security
How email is protected in transit with TLS, and how to keep API keys and webhooks from becoming a way into your account.
5 min read
TLS in transit
Mail servers upgrade their connections to TLS with STARTTLS, which encrypts the message while it travels between servers. Today the large majority of email between major providers is encrypted this way.
Plain STARTTLS is opportunistic: if a server doesn’t offer it, mail may fall back to an unencrypted connection. MTA-STS lets a receiving domain require TLS with a valid certificate, and TLS-RPT sends reports when that fails.
Treat API keys like passwords
- Create one key per application or environment, with only the scopes it needs — a server that only sends email needs only emails:send.
- Keep keys in environment variables or a secrets manager, never in source control or front-end code.
- Rotate keys when someone with access leaves, and revoke any key you suspect has leaked — revocation takes effect immediately.
Verify every webhook
Anyone can POST to a public URL, so a webhook handler that trusts the payload blindly can be fed fake events. MailCraft signs every delivery with an HMAC of the timestamp and body, using your endpoint’s secret.
Recompute the signature with a constant-time comparison before acting on a webhook, and reject deliveries whose timestamp is more than a few minutes old to stop replays.
Stop others sending as you
Security for email is also about your domain’s name. A DMARC policy of quarantine or reject stops attackers from sending phishing mail that appears to come from your domain — the single most effective anti-spoofing measure available.